It seems that in Java plug-in 1.2.2 applets residing locally on
the classpath are treated regarded as being on the bootclasspath
and given all privileges. This contradicts Java 2 security model,
where code on the classpath is treated like any other code and
is subject to the policy. This has obvious security implications.
It seems this is intentional (in CJavaJNI::StartJavaVirtualMachine
the classpath is passed as the bootclasspath), but it is not clear
why this is done (backward compatibility) and in any case it is not
reflected in the Java plug-in documentation.