A web application server with built-in object capability security