Reduce access bits

Any capability in a capability register may be replaced by a capability identical to the original, except that some access bits are turned off which were on in the original. Thus access available through a capability may be reduced before passing it to less privileged programs.