Not default permissions, it turns out, but you have a global choice between letting sites ask for permission or blocking the requests entirely.