Browser Instance Permissions

[brianmcd]

Need access control for browsers:

• Restrict based on shared password.
• Restrict based on OpenID username (assuming we can get that info).

Need different permission levels for clients on a browser:

• Read-only: can view a co-browsing session, but events from that client aren't sent to server.
• Read-write: can view a co-browsing session, and events from that client are sent to the server.