Runtime and Security Model for Hosted Web Applications and Packaged Applications