So facebook does nothing to restrict apps to the permissions they request? what's the point then?