Seol mar théacs é seo: Analysing the Security Properties of Object−Capability Patterns