It should not allow "registering" on matches that don't have permission to

[fregante]

Firefox throws an error if you don't have permission:

browser.contentScripts.register({
  css: [{code: '*{background:red}'}],
    matches: ['*://*/*']
})

Error: Permission denied to register a content script for *://*/*

Not technically a bug since the injection isn't successful anyway.