Use CapabilityFilter to restrict what HTMLViewers can connect to.

mojo/application/public/cpp/lib/application_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/application/public/cpp/application_impl.h"
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 41 matching lines @@
       termination_closure_(termination_closure),
       app_lifetime_helper_(this),
       quit_requested_(false),
       weak_factory_(this) {}
 
 ApplicationImpl::~ApplicationImpl() {
   app_lifetime_helper_.OnQuit();
 }
 
 scoped_ptr<ApplicationConnection> ApplicationImpl::ConnectToApplication(
-    mojo::URLRequestPtr request,
-    CapabilityFilterPtr filter) {
+    URLRequestPtr request) {
+  return ConnectToApplicationWithCapabilityFilter(request.Pass(), nullptr);
+}
+
+scoped_ptr<ApplicationConnection>
+    ApplicationImpl::ConnectToApplicationWithCapabilityFilter(
+        URLRequestPtr request,
+        CapabilityFilterPtr filter) {
   if (!shell_)
     return nullptr;
   ServiceProviderPtr local_services;
   InterfaceRequest<ServiceProvider> local_request = GetProxy(&local_services);
   ServiceProviderPtr remote_services;
   std::string application_url = request->url.To<std::string>();
   shell_->ConnectToApplication(request.Pass(), GetProxy(&remote_services),
                                local_services.Pass(), filter.Pass());
   // We allow all interfaces on outgoing connections since we are presumably in
   // a position to know who we're talking to.
@@ skipping 77 matching lines @@
 }
 
 void ApplicationImpl::UnbindConnections(
     InterfaceRequest<Application>* application_request,
     ShellPtr* shell) {
   *application_request = binding_.Unbind();
   shell->Bind(shell_.PassInterface());
 }
 
 }  // namespace mojo