Your session in your OS is already protected by credentials (passwords, tokens).
The illusion of security given by inputing and multiplying passwords might not beat having a central point of authentication handled by the OS. EDIT: and you have system accountability for free.
User sessions and applications are to be already limited by the OS why redo it?
And like it or not a browser is a millions sloc application that have access to everything potentially. You just trust mozilla, google, apple to not access everything. But have you audited their codebase?