They way apps get permissions has changed as of API 23. If the device is running Android 6.0 or higher, and your app’s target SDK is 23 or higher: The app has to list the permissions in the manifest, and it must request each dangerous permission it needs while the app is running. The user can grant or deny each permission, and the app can continue to run with limited capabilities even if the user denies a permission request.

You still want to keep this line in your manifest:

<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

In addition, you will need to add the following line at the end of MainActivity.onCreate():

ActivityCompat.requestPermissions(this, new String[]{Manifest.permission.WRITE_EXTERNAL_STORAGE}, 0);

So that method will look like this:

public void onCreate(Bundle saveInstBundle) 
{
super.onCreate(saveInstBundle);
JavaScriptSettings.setJSEnabled(JavaScriptSettings.ALWAYS);
notesView = new QPDFNotesView(this);
notesView.setActivity(this);
setContentView(notesView);
ActivityCompat.requestPermissions(this, new String[]{Manifest.permission.WRITE_EXTERNAL_STORAGE}, 0); 
}

The following articles will be of interest to you:

https://developer.android.com/guide/topics/security/permissions.html#permissions

https://developer.android.com/training/permissions/requesting.html