Revision 73221 of Scripting plugins

<h2 name="Security_model">Security model</h2>
<p>The security model for making calls through this API is much like the general <a class="external" href="https://www.mozilla.org/projects/security/components/same-origin.html">same-origin</a> security model enforced by the browser. That means that script from an origin other than the origin of the page that loaded the plugin is not able to access methods and properties on the plugin. The same thing applies the other way too, the plugin can reach only JavaScript objects in the same origin as the page that loaded the plugin.</p>
<p>In addition to this, a further extension to this API is being discussed that would give a plugin greater flexibility by letting the plugin control the origin of the calling code, so that the plugin can specify the origin of calls that come from internally loaded code from other origins. This way such code can be executed with only the privileges of the origin of the code, and not the privileges of the plugin page's origin.</p>