This is a thin wrapper around a capability ptr that releases the capability when it is done and prevents copying/cloning it. To get a copy a caller must explicitly use duplicate.
