Caja is something you can do server-side to filter JavaScript. COWL is a modification to the browser security architecture. Hence, unlike Caja, a web site cannot unilaterally deploy COWL. On the other hand, if COWL or something like it makes it through the standardization process, it would have a far more significant impact on web security than Caja.