Use CapabilityFilter to restrict what HTMLViewers can connect to.

mojo/application/public/cpp/application_impl.h

Index: mojo/application/public/cpp/application_impl.h
diff --git a/mojo/application/public/cpp/application_impl.h b/mojo/application/public/cpp/application_impl.h
index b2e9675ade244a744a84ea500e26f59ddd736c23..9b587b283dae6765f725f2f3b00609b3fd1f3a3f 100644
--- a/mojo/application/public/cpp/application_impl.h
+++ b/mojo/application/public/cpp/application_impl.h
@@ -94,11 +94,10 @@ class ApplicationImpl : public Application {
   // Requests a new connection to an application. Returns a pointer to the
   // connection if the connection is permitted by this application's delegate,
   // or nullptr otherwise. Caller takes ownership.
-  // TODO(beng): consider replacing default value in a separate CL per style
-  //             guide.
-  scoped_ptr<ApplicationConnection> ConnectToApplication(
+  scoped_ptr<ApplicationConnection> ConnectToApplication(URLRequestPtr request);
+  scoped_ptr<ApplicationConnection> ConnectToApplicationWithCapabilityFilter(
       URLRequestPtr request,
-      CapabilityFilterPtr filter = nullptr);
+      CapabilityFilterPtr filter);
 
   // Connect to application identified by |request->url| and connect to the
   // service implementation of the interface identified by |Interface|.