Would capability-based security be more effective than what Java attempted for in-process isolation?