Capability Security in Java