Request for comments: capability security for Web applications

It's probably a good idea to refer to previous work such as Waterken.