The whole thing's a mis-feature. If it must exist at all, sites shouldn't be able to prompt for it, but simply advertise the functionality and let browsers add a little button or something for the user to actively engage with if they want to see a permissions prompt. Like the way browsers used to handle sites that advertised RSS feeds.