> Isn't this more or less what Sun tried to do with Java applets, which in practice turned out not to be so simple while providing a rich API?

I'm not familiar with the Java applet model specifically, but Java's general security model is based on stack inspection, which is nothing like capabilities.