Embracing the web security model