Use CapabilityFilter to restrict what HTMLViewers can connect to.

mojo/application/public/cpp/lib/application_impl.cc

Index: mojo/application/public/cpp/lib/application_impl.cc
diff --git a/mojo/application/public/cpp/lib/application_impl.cc b/mojo/application/public/cpp/lib/application_impl.cc
index aafd4586a7ef452e16399a8e26424836d29c90d0..62797030d395b929ef7c7b6bd7ca45eb82fb72d2 100644
--- a/mojo/application/public/cpp/lib/application_impl.cc
+++ b/mojo/application/public/cpp/lib/application_impl.cc
@@ -59,8 +59,14 @@ ApplicationImpl::~ApplicationImpl() {
 }
 
 scoped_ptr<ApplicationConnection> ApplicationImpl::ConnectToApplication(
-    mojo::URLRequestPtr request,
-    CapabilityFilterPtr filter) {
+    URLRequestPtr request) {
+  return ConnectToApplicationWithCapabilityFilter(request.Pass(), nullptr);
+}
+
+scoped_ptr<ApplicationConnection>
+    ApplicationImpl::ConnectToApplicationWithCapabilityFilter(
+        URLRequestPtr request,
+        CapabilityFilterPtr filter) {
   if (!shell_)
     return nullptr;
   ServiceProviderPtr local_services;