Use CapabilityFilter to restrict what HTMLViewers can connect to.

mojo/application/public/cpp/application_impl.h

Index: mojo/application/public/cpp/application_impl.h
diff --git a/mojo/application/public/cpp/application_impl.h b/mojo/application/public/cpp/application_impl.h
index e05e741144499c835e45f4357804a1c23fcb0501..92677ab4bdbb652770f3b11d9bf5929b2053ba49 100644
--- a/mojo/application/public/cpp/application_impl.h
+++ b/mojo/application/public/cpp/application_impl.h
@@ -80,11 +80,10 @@ class ApplicationImpl : public Application {
   // Requests a new connection to an application. Returns a pointer to the
   // connection if the connection is permitted by this application's delegate,
   // or nullptr otherwise. Caller takes ownership.
-  // TODO(beng): consider replacing default value in a separate CL per style
-  //             guide.
-  scoped_ptr<ApplicationConnection> ConnectToApplication(
+  scoped_ptr<ApplicationConnection> ConnectToApplication(URLRequestPtr request);
+  scoped_ptr<ApplicationConnection> ConnectToApplicationWithCapabilityFilter(
       URLRequestPtr request,
-      CapabilityFilterPtr filter = nullptr);
+      CapabilityFilterPtr filter);
 
   // Connect to application identified by |request->url| and connect to the
   // service implementation of the interface identified by |Interface|.