A threat model for accessibility on the web