It's great to see object-capability security being discussed on here! Mark Miller, Ben Laurie, and Mark Lentczner are working on how to apply this 1980s research in a web context at <a href="https://sites.google.com/site/belayresearchproject/" rel="nofollow">https://sites.google.com/site/belayresearchproject/</a> under the name "Belay". They're still in early stages...