"When the user installs or updates the app, the system grants the app all permissions that the app requests that fall under PROTECTION_NORMAL. For example, alarm clock and internet permissions fall under PROTECTION_NORMAL, so they are automatically granted at install time."

Based on the Android 5.1 source, there are a lot of permissions in the "normal" group, which will apparently now be accepted automatically at install time:

  $ curl -sL http://git.io/vklnX | grep -B2 'protectionLevel="normal"' | grep name | cut -d'"' -f2 | sort
  android.permission.ACCESS_LOCATION_EXTRA_COMMANDS
  android.permission.ACCESS_NETWORK_STATE
  android.permission.ACCESS_WIFI_STATE
  android.permission.ACCESS_WIMAX_STATE
  android.permission.BROADCAST_STICKY
  android.permission.CHANGE_NETWORK_STATE
  android.permission.EXPAND_STATUS_BAR
  android.permission.FLASHLIGHT
  android.permission.GET_ACCOUNTS
  android.permission.GET_PACKAGE_SIZE
  android.permission.GET_TASKS
  android.permission.KILL_BACKGROUND_PROCESSES
  android.permission.MODIFY_AUDIO_SETTINGS
  android.permission.PERSISTENT_ACTIVITY
  android.permission.READ_SYNC_SETTINGS
  android.permission.READ_SYNC_STATS
  android.permission.RECEIVE_BOOT_COMPLETED
  android.permission.REORDER_TASKS
  android.permission.RESTART_PACKAGES
  android.permission.SET_TIME_ZONE
  android.permission.SET_WALLPAPER
  android.permission.SET_WALLPAPER_HINTS
  android.permission.TRANSMIT_IR
  android.permission.VIBRATE
  android.permission.WAKE_LOCK
  android.permission.WRITE_SETTINGS
  android.permission.WRITE_SYNC_SETTINGS
  android.permission.WRITE_USER_DICTIONARY

Though note that the INTERNET permission is currently in the "dangerous" permission group, so I guess some changes have been made for Android M.