Object Security Attributes: Enabling Application-Specific Access Control in Middleware