pull down to refresh

Why does attaching LND need address and onchain permission macaroons? https://github.com/stackernews/stacker.news/blob/master/lib/macaroon.js#L61
Shouldn't invoice:write be sufficient for auto withdrawls?
It doesn't need them, but I didn't anticipate people baking their own macaroons with granular perms. I assumed people would use the default macaroons.
If you wouldn't mind opening an issue I can narrow the perm check.