Pitfalls of the Java Permissions Model