Web pages are increasingly powerful—asking for notifications, webcam access, or location—but this great power comes with great vulnerabilities.