Types and Roles for Web Security