Re: [push-api] getSubscription() should permission check (#150)

I think that this is simple.  `getSubscription` doesn't need to check permissions, it only needs to retrieve the current subscription.  If the origin doesn't have permission, then this retrieval had better result in `null`.

I think that the current steps are fine.  I could add a point to the algorithm that notes that an worker without permission will always have no subscription.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/push-api/issues/150#issuecomment-149985255