I'm working on a facebook app right now. In A/B testing the permissions, it doesn't matter how many things we ask for, the results are about the same. So might as well ask for anything we think will be useful.
As for asking for permissions later, since it doesn't seem to matter we ask for all the ones we need up front. We've found that gradually asking for permissions as needed annoys the user and breaks up the app flow.