Hardening Java's Access Control by Abolishing Implicit Privilege Elevation