From: Ben Hutchings <redacted>
Date: Fri, 25 Feb 2011 19:07:59 +0000

You realise that module loading doesn't actually run in the context of
request_module(), right?

Why is that a barrier?  We could simply pass a capability mask into
request_module if necessary.

It's an implementation detail, and not a deterrant to my suggested
scheme.