Use CapabilityFilter to restrict what HTMLViewers can connect to.

mojo/application/public/cpp/lib/application_impl.cc

Index: mojo/application/public/cpp/lib/application_impl.cc
diff --git a/mojo/application/public/cpp/lib/application_impl.cc b/mojo/application/public/cpp/lib/application_impl.cc
index 9f2c419c36e3a910da8b4815ea399dc5b1448cf2..cc045c99bc8c3e17fd00e31fd0a981f8b420d372 100644
--- a/mojo/application/public/cpp/lib/application_impl.cc
+++ b/mojo/application/public/cpp/lib/application_impl.cc
@@ -59,8 +59,14 @@ ApplicationImpl::~ApplicationImpl() {
 }
 
 scoped_ptr<ApplicationConnection> ApplicationImpl::ConnectToApplication(
-    mojo::URLRequestPtr request,
-    CapabilityFilterPtr filter) {
+    URLRequestPtr request) {
+  return ConnectToApplicationWithCapabilityFilter(request.Pass(), nullptr);
+}
+
+scoped_ptr<ApplicationConnection>
+    ApplicationImpl::ConnectToApplicationWithCapabilityFilter(
+        URLRequestPtr request,
+        CapabilityFilterPtr filter) {
   if (!shell_)
     return nullptr;
   ServiceProviderPtr local_services;