So, I've done some more programming, and I'm now up to version 0.012. for my Capabilities demo.
The main page at http://127.0.0.1:81 is now the user page, with the protected content. You have to have a capabilities token to edit the data.
The administration page is at http://127.0.0.1:81/admin, which allows you to create and revoke capabilities, and see the current "protected content".
It's all implemented in python, in a single file, just to make it easy to demo.