An architecture for enforcing end-to-end access control over web applications