Pass CapabilityFilter via CreateInstanceForHandle

mojo/shell/application_manager.cc

Index: mojo/shell/application_manager.cc
diff --git a/mojo/shell/application_manager.cc b/mojo/shell/application_manager.cc
index 1e9e2a7da6f26a6b257e16f596c192a84cdba4da..aea813b4576eb166f3cbff3f1240dcbc08e058dc 100644
--- a/mojo/shell/application_manager.cc
+++ b/mojo/shell/application_manager.cc
@@ -117,14 +117,18 @@ ApplicationInstance* ApplicationManager::GetApplicationInstance(
 }
 
 void ApplicationManager::CreateInstanceForHandle(ScopedHandle channel,
-                                                 const GURL& url) {
+                                                 const GURL& url,
+                                                 CapabilityFilterPtr filter) {
   // Instances created by others are considered unique, and thus have no
   // identity. As such they cannot be connected to by anyone else, and so we
   // never call ConnectToClient().
   // TODO(beng): GetPermissiveCapabilityFilter() here obviously cannot make it
   //             to production. See note in application_manager.mojom.
   //             http://crbug.com/555392
-  Identity target_id(url, std::string(), GetPermissiveCapabilityFilter());
+  CapabilityFilter local_filter;
+  if (!filter.is_null())

[sky, 2015/11/22 15:27:31]

Do you want to use the permissive filter if no filter is specified?

[Ben Goodger (Google), 2015/11/24 00:29:36]

Nope we specifically decided a null filter should be default (principle of least
privilege).

+    local_filter = filter->filter.To<CapabilityFilter>();
+  Identity target_id(url, std::string(), local_filter);
   InterfaceRequest<Application> application_request =
       CreateInstance(target_id, base::Closure(), nullptr);
   NativeRunner* runner =