Use a separate window to notify the user that permissions are required.

remoting/webapp/app_remoting/js/app_remoting.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview
  * This class implements the functionality that is specific to application
  * remoting ("AppRemoting" or AR).
  */
 
@@ skipping 73 matching lines @@
   // Initialize the context menus.
   if (remoting.platformIsChromeOS()) {
     var adapter = new remoting.ContextMenuChrome();
   } else {
     var adapter = new remoting.ContextMenuDom(
         document.getElementById('context-menu'));
   }
   this.contextMenu_ = new remoting.ApplicationContextMenu(adapter);
   this.keyboardLayoutsMenu_ = new remoting.KeyboardLayoutsMenu(adapter);
   this.windowActivationMenu_ = new remoting.WindowActivationMenu(adapter);
-
-  remoting.LoadingWindow.show();

[Jamie, 2015/03/21 01:18:23]

Showing this dialog in init() is not correct, as we haven't started connecting
yet. It also means that we either have to close the loading window explicitly
when we show the auth window (which introduces an awkward dependency) or have
two dialogs on screen at the same time. The only situation in which there is an
appreciable lag between init() and start() is when the user needs to approve
permissions, in which case the identity API is showing its own UI. In all cases,
it's safe to defer showing the loading window until start().

[garykac, 2015/03/23 23:25:33]

Sounds good.

 };
 
 /**
  * Start the application. Once start() is called, the delegate can assume that
  * the user has consented to all permissions specified in the manifest.
  *
  * @param {remoting.SessionConnector} connector
  * @param {string} token An OAuth access token. The delegate should not cache
  *     this token, but can assume that it will remain valid during application
  *     start-up.
  */
 remoting.AppRemoting.prototype.start = function(connector, token) {
+  remoting.LoadingWindow.show();
+
   /** @type {remoting.AppRemoting} */
   var that = this;
 
   /** @param {XMLHttpRequest} xhr */
   var parseAppHostResponse = function(xhr) {
     if (xhr.status == 200) {
       var response = /** @type {remoting.AppRemoting.AppHostResponse} */
           (base.jsonParseSafe(xhr.responseText));
       if (response &&
           response.status &&
@@ skipping 251 matching lines @@
       chrome.i18n.getMessage(/*i18n-content*/'CONNECTION_FAILED'),
       chrome.i18n.getMessage(error.getTag()));
 };
 
 /**
  * Close the loading window before exiting.
  */
 remoting.AppRemoting.prototype.handleExit = function() {
   remoting.LoadingWindow.close();
 };