Initial version of the same-origin policy model in Alloy

This initial version contains Alloy models of:
* client-server model with HTTP 
* the same origin policy
* the cross-origin sharing 
* security property

To add for the future versions:
* model documentation
* JSONP
* PostMessage
I'm curious why we had to introduce an email application to motivate concrete examples of security violations that the SOP mitigates. When I started reading this section, I assumed it was tangential, but it ended up being used to explain the core premise of this article. Were there things in this example that were easier to explain or more tractable than using a "generic web application" and a browser?