diff --git a/content/browser/mojo/mojo_shell_context.cc b/content/browser/mojo/mojo_shell_context.cc
index 45d22736742fe9..2c94008b0b694f 100644
--- a/content/browser/mojo/mojo_shell_context.cc
+++ b/content/browser/mojo/mojo_shell_context.cc
@@ -237,12 +237,12 @@ void MojoShellContext::ConnectToApplicationOnOwnThread(
     const mojo::Shell::ConnectToApplicationCallback& callback) {
   scoped_ptr<mojo::shell::ConnectToApplicationParams> params(
       new mojo::shell::ConnectToApplicationParams);
-  params->set_originator_identity(mojo::shell::Identity(requestor_url));
-  params->set_originator_filter(mojo::shell::GetPermissiveCapabilityFilter());
-  params->SetURLInfo(url);
+  params->set_source(
+      mojo::shell::Identity(requestor_url, std::string(),
+                            mojo::shell::GetPermissiveCapabilityFilter()));
+  params->SetTarget(mojo::shell::Identity(url, std::string(), filter));
   params->set_services(request.Pass());
   params->set_exposed_services(exposed_services.Pass());
-  params->set_filter(filter);
   params->set_on_application_end(base::Bind(&base::DoNothing));
   params->set_connect_callback(callback);
   application_manager_->ConnectToApplication(params.Pass());
diff --git a/mojo/fetcher/about_fetcher_unittest.cc b/mojo/fetcher/about_fetcher_unittest.cc
index 27c8e6a75681b8..de256d7b9fbb06 100644
--- a/mojo/fetcher/about_fetcher_unittest.cc
+++ b/mojo/fetcher/about_fetcher_unittest.cc
@@ -110,12 +110,9 @@ class AboutFetcherTest : public testing::Test {
     service_provider.set_connection_error_handler(
         [&run_loop]() { run_loop.Quit(); });
 
-    URLRequestPtr request(URLRequest::New());
-    request->url = url;
-
     scoped_ptr<shell::ConnectToApplicationParams> params(
         new shell::ConnectToApplicationParams);
-    params->SetURLInfo(request.Pass());
+    params->SetTargetURL(GURL(url));
     params->set_services(service_provider_request.Pass());
     application_manager_->ConnectToApplication(params.Pass());
 
diff --git a/mojo/runner/context.cc b/mojo/runner/context.cc
index 048de9bf4be3c8..3e42b565fb951c 100644
--- a/mojo/runner/context.cc
+++ b/mojo/runner/context.cc
@@ -125,11 +125,9 @@ void InitDevToolsServiceIfNeeded(shell::ApplicationManager* manager,
   ServiceProviderPtr devtools_service_provider;
   scoped_ptr<shell::ConnectToApplicationParams> params(
       new shell::ConnectToApplicationParams);
-  params->set_originator_identity(shell::Identity(GURL("mojo:shell")));
-  params->set_originator_filter(shell::GetPermissiveCapabilityFilter());
-  params->SetURLInfo(GURL("mojo:devtools_service"));
+  params->set_source(shell::Identity(GURL("mojo:shell")));
+  params->SetTargetURL(GURL("mojo:devtools_service"));
   params->set_services(GetProxy(&devtools_service_provider));
-  params->set_filter(shell::GetPermissiveCapabilityFilter());
   manager->ConnectToApplication(params.Pass());
 
   devtools_service::DevToolsCoordinatorPtr devtools_coordinator;
@@ -207,15 +205,12 @@ bool Context::Init() {
   ServiceProviderPtr service_provider_ptr;
   ServiceProviderPtr tracing_service_provider_ptr;
   new TracingServiceProvider(GetProxy(&tracing_service_provider_ptr));
-  mojo::URLRequestPtr request(mojo::URLRequest::New());
-  request->url = mojo::String::From("mojo:tracing");
 
   scoped_ptr<shell::ConnectToApplicationParams> params(
       new shell::ConnectToApplicationParams);
-  params->SetURLInfo(request.Pass());
+  params->SetTargetURL(GURL("mojo:tracing"));
   params->set_services(GetProxy(&service_provider_ptr));
   params->set_exposed_services(tracing_service_provider_ptr.Pass());
-  params->set_filter(shell::GetPermissiveCapabilityFilter());
   application_manager_->ConnectToApplication(params.Pass());
 
   // Record the shell startup metrics used for performance testing.
@@ -264,15 +259,13 @@ void Context::Run(const GURL& url) {
   ServiceProviderPtr exposed_services;
 
   app_urls_.insert(url);
-  mojo::URLRequestPtr request(mojo::URLRequest::New());
-  request->url = mojo::String::From(url.spec());
 
   scoped_ptr<shell::ConnectToApplicationParams> params(
       new shell::ConnectToApplicationParams);
-  params->SetURLInfo(request.Pass());
+  params->SetTarget(shell::Identity(url, std::string(),
+                                    shell::GetPermissiveCapabilityFilter()));
   params->set_services(GetProxy(&services));
   params->set_exposed_services(exposed_services.Pass());
-  params->set_filter(shell::GetPermissiveCapabilityFilter());
   params->set_on_application_end(
       base::Bind(&Context::OnApplicationEnd, base::Unretained(this), url));
   application_manager_->ConnectToApplication(params.Pass());
diff --git a/mojo/runner/native_runner_unittest.cc b/mojo/runner/native_runner_unittest.cc
index e4a636d7b246be..25f01a6208556c 100644
--- a/mojo/runner/native_runner_unittest.cc
+++ b/mojo/runner/native_runner_unittest.cc
@@ -92,15 +92,12 @@ TEST_F(NativeApplicationLoaderTest, DoesNotExist) {
   GURL url(util::FilePathToFileURL(temp_dir.path().Append(nonexistent_file)));
   InterfaceRequest<ServiceProvider> services;
   ServiceProviderPtr service_provider;
-  mojo::URLRequestPtr request(mojo::URLRequest::New());
-  request->url = mojo::String::From(url.spec());
 
   scoped_ptr<shell::ConnectToApplicationParams> params(
       new shell::ConnectToApplicationParams);
-  params->SetURLInfo(request.Pass());
+  params->SetTargetURL(url);
   params->set_services(services.Pass());
   params->set_exposed_services(service_provider.Pass());
-  params->set_filter(shell::GetPermissiveCapabilityFilter());
   context_->application_manager()->ConnectToApplication(params.Pass());
   EXPECT_FALSE(state_.runner_was_created);
   EXPECT_FALSE(state_.runner_was_started);
diff --git a/mojo/runner/shell_test_base.cc b/mojo/runner/shell_test_base.cc
index 517a6910ceed94..07f9d826c1c219 100644
--- a/mojo/runner/shell_test_base.cc
+++ b/mojo/runner/shell_test_base.cc
@@ -47,14 +47,12 @@ ScopedMessagePipeHandle ShellTestBase::ConnectToService(
     const GURL& application_url,
     const std::string& service_name) {
   ServiceProviderPtr services;
-  mojo::URLRequestPtr request(mojo::URLRequest::New());
-  request->url = mojo::String::From(application_url.spec());
 
   scoped_ptr<shell::ConnectToApplicationParams> params(
       new shell::ConnectToApplicationParams);
-  params->SetURLInfo(request.Pass());
+  params->SetTarget(shell::Identity(application_url, std::string(),
+                                    shell::GetPermissiveCapabilityFilter()));
   params->set_services(GetProxy(&services));
-  params->set_filter(shell::GetPermissiveCapabilityFilter());
   params->set_on_application_end(base::Bind(&QuitIfRunning));
   shell_context_.application_manager()->ConnectToApplication(params.Pass());
   MessagePipe pipe;
diff --git a/mojo/shell/application_instance.cc b/mojo/shell/application_instance.cc
index 643cfa2289e849..34237b0e61d410 100644
--- a/mojo/shell/application_instance.cc
+++ b/mojo/shell/application_instance.cc
@@ -14,38 +14,17 @@
 
 namespace mojo {
 namespace shell {
-namespace {
-
-// It's valid to specify mojo: URLs in the filter either as mojo:foo or
-// mojo://foo/ - but we store the filter in the latter form.
-CapabilityFilter CanonicalizeFilter(const CapabilityFilter& filter) {
-  CapabilityFilter canonicalized;
-  for (CapabilityFilter::const_iterator it = filter.begin();
-       it != filter.end();
-       ++it) {
-    if (it->first == "*")
-      canonicalized[it->first] = it->second;
-    else
-      canonicalized[GURL(it->first).spec()] = it->second;
-  }
-  return canonicalized;
-}
-
-}  // namespace
 
 ApplicationInstance::ApplicationInstance(
     ApplicationPtr application,
     ApplicationManager* manager,
-    const Identity& originator_identity,
     const Identity& identity,
-    const CapabilityFilter& filter,
     uint32_t requesting_content_handler_id,
     const base::Closure& on_application_end)
     : manager_(manager),
-      originator_identity_(originator_identity),
       identity_(identity),
-      filter_(CanonicalizeFilter(filter)),
-      allow_any_application_(filter.size() == 1 && filter.count("*") == 1),
+      allow_any_application_(identity.filter().size() == 1 &&
+                             identity.filter().count("*") == 1),
       requesting_content_handler_id_(requesting_content_handler_id),
       on_application_end_(on_application_end),
       application_(application.Pass()),
@@ -63,7 +42,7 @@ ApplicationInstance::~ApplicationInstance() {
 void ApplicationInstance::InitializeApplication() {
   ShellPtr shell;
   binding_.Bind(GetProxy(&shell));
-  application_->Initialize(shell.Pass(), identity_.url.spec());
+  application_->Initialize(shell.Pass(), identity_.url().spec());
 }
 
 void ApplicationInstance::ConnectToClient(
@@ -90,23 +69,26 @@ void ApplicationInstance::ConnectToApplication(
     callback.Run(kInvalidContentHandlerID);
     return;
   }
-  if (allow_any_application_ || filter_.find(url.spec()) != filter_.end()) {
+  if (allow_any_application_ ||
+      identity_.filter().find(url.spec()) != identity_.filter().end()) {
     CapabilityFilter capability_filter = GetPermissiveCapabilityFilter();
     if (!filter.is_null())
       capability_filter = filter->filter.To<CapabilityFilter>();
 
     scoped_ptr<ConnectToApplicationParams> params(
         new ConnectToApplicationParams);
-    params->SetOriginatorInfo(this);
-    params->SetURLInfo(app_request.Pass());
+    params->SetSource(this);
+    GURL app_url(app_request->url);
+    params->SetTargetURLRequest(
+        app_request.Pass(),
+        Identity(app_url, std::string(), capability_filter));
     params->set_services(services.Pass());
     params->set_exposed_services(exposed_services.Pass());
-    params->set_filter(capability_filter);
     params->set_connect_callback(callback);
     manager_->ConnectToApplication(params.Pass());
   } else {
     LOG(WARNING) << "CapabilityFilter prevented connection from: " <<
-        identity_.url << " to: " << url.spec();
+        identity_.url() << " to: " << url.spec();
     callback.Run(kInvalidContentHandlerID);
   }
 }
@@ -123,13 +105,13 @@ void ApplicationInstance::CallAcceptConnection(
   params->connect_callback().Run(requesting_content_handler_id_);
   AllowedInterfaces interfaces;
   interfaces.insert("*");
-  if (!params->originator_identity().is_null())
-    interfaces = GetAllowedInterfaces(params->originator_filter(), identity_);
+  if (!params->source().is_null())
+    interfaces = GetAllowedInterfaces(params->source().filter(), identity_);
 
   application_->AcceptConnection(
-      params->originator_identity().url.spec(), params->TakeServices(),
+      params->source().url().spec(), params->TakeServices(),
       params->TakeExposedServices(), Array<String>::From(interfaces).Pass(),
-      params->app_url().spec());
+      params->target().url().spec());
 }
 
 void ApplicationInstance::OnConnectionError() {
@@ -142,8 +124,8 @@ void ApplicationInstance::OnConnectionError() {
   // If any queued requests came to shell during time it was shutting down,
   // start them now.
   for (auto request : queued_client_requests) {
-    // Unfortunately, it is possible that |request->app_url_request()| is null
-    // at this point. Consider the following sequence:
+    // Unfortunately, it is possible that |request->target_url_request()| is
+    // null at this point. Consider the following sequence:
     // 1) connect_request_1 arrives at the application manager; the manager
     //    decides to fetch the app.
     // 2) connect_request_2 arrives for the same app; because the app is not
@@ -160,10 +142,10 @@ void ApplicationInstance::OnConnectionError() {
     // before starting the fetch. So at step (2) the application manager knows
     // that it can wait for the first fetch to complete instead of doing a
     // second one directly.
-    if (!request->app_url_request()) {
+    if (!request->target_url_request()) {
       URLRequestPtr url_request = mojo::URLRequest::New();
-      url_request->url = request->app_url().spec();
-      request->SetURLInfo(url_request.Pass());
+      url_request->url = request->target().url().spec();
+      request->SetTargetURLRequest(url_request.Pass(), request->target());
     }
     manager->ConnectToApplication(make_scoped_ptr(request));
   }
diff --git a/mojo/shell/application_instance.h b/mojo/shell/application_instance.h
index 06e611e3ff4007..a99a3856b810be 100644
--- a/mojo/shell/application_instance.h
+++ b/mojo/shell/application_instance.h
@@ -31,9 +31,7 @@ class ApplicationInstance : public Shell {
   // is kInvalidContentHandlerID.
   ApplicationInstance(ApplicationPtr application,
                       ApplicationManager* manager,
-                      const Identity& originator_identity,
-                      const Identity& resolved_identity,
-                      const CapabilityFilter& filter,
+                      const Identity& identity,
                       uint32_t requesting_content_handler_id,
                       const base::Closure& on_application_end);
 
@@ -45,7 +43,6 @@ class ApplicationInstance : public Shell {
 
   Application* application() { return application_.get(); }
   const Identity& identity() const { return identity_; }
-  const CapabilityFilter& filter() const { return filter_; }
   base::Closure on_application_end() const { return on_application_end_; }
   void set_requesting_content_handler_id(uint32_t id) {
     requesting_content_handler_id_ = id;
@@ -71,9 +68,7 @@ class ApplicationInstance : public Shell {
   void OnQuitRequestedResult(bool can_quit);
 
   ApplicationManager* const manager_;
-  const Identity originator_identity_;
   const Identity identity_;
-  const CapabilityFilter filter_;
   const bool allow_any_application_;
   uint32_t requesting_content_handler_id_;
   base::Closure on_application_end_;
diff --git a/mojo/shell/application_manager.cc b/mojo/shell/application_manager.cc
index 7ca0d392c2ea1c..26886259f2d5a6 100644
--- a/mojo/shell/application_manager.cc
+++ b/mojo/shell/application_manager.cc
@@ -75,21 +75,21 @@ void ApplicationManager::ConnectToApplication(
     scoped_ptr<ConnectToApplicationParams> params) {
   TRACE_EVENT_INSTANT1("mojo_shell", "ApplicationManager::ConnectToApplication",
                        TRACE_EVENT_SCOPE_THREAD, "original_url",
-                       params->app_url().spec());
-  DCHECK(params->app_url().is_valid());
+                       params->target().url().spec());
+  DCHECK(params->target().url().is_valid());
 
   // Connect to an existing matching instance, if possible.
   if (ConnectToRunningApplication(&params))
     return;
 
-  ApplicationLoader* loader = GetLoaderForURL(params->app_url());
+  ApplicationLoader* loader = GetLoaderForURL(params->target().url());
   if (loader) {
-    GURL url = params->app_url();
+    GURL url = params->target().url();
     loader->Load(url, CreateInstance(params.Pass(), nullptr));
     return;
   }
 
-  URLRequestPtr original_url_request = params->TakeAppURLRequest();
+  URLRequestPtr original_url_request = params->TakeTargetURLRequest();
   auto callback =
       base::Bind(&ApplicationManager::HandleFetchCallback,
                  weak_ptr_factory_.GetWeakPtr(), base::Passed(&params));
@@ -98,8 +98,7 @@ void ApplicationManager::ConnectToApplication(
 
 bool ApplicationManager::ConnectToRunningApplication(
     scoped_ptr<ConnectToApplicationParams>* params) {
-  ApplicationInstance* instance = GetApplicationInstance(
-      Identity((*params)->app_url(), (*params)->qualifier()));
+  ApplicationInstance* instance = GetApplicationInstance((*params)->target());
   if (!instance)
     return false;
 
@@ -110,17 +109,15 @@ bool ApplicationManager::ConnectToRunningApplication(
 InterfaceRequest<Application> ApplicationManager::CreateInstance(
     scoped_ptr<ConnectToApplicationParams> params,
     ApplicationInstance** resulting_instance) {
-  Identity app_identity(params->app_url(), params->qualifier());
-
+  Identity target_id = params->target();
   ApplicationPtr application;
   InterfaceRequest<Application> application_request = GetProxy(&application);
   ApplicationInstance* instance = new ApplicationInstance(
-      application.Pass(), this, params->originator_identity(), app_identity,
-      params->filter(), Shell::kInvalidContentHandlerID,
+      application.Pass(), this, target_id, Shell::kInvalidContentHandlerID,
       params->on_application_end());
-  DCHECK(identity_to_instance_.find(app_identity) ==
+  DCHECK(identity_to_instance_.find(target_id) ==
          identity_to_instance_.end());
-  identity_to_instance_[app_identity] = instance;
+  identity_to_instance_[target_id] = instance;
   instance->InitializeApplication();
   instance->ConnectToClient(params.Pass());
   if (resulting_instance)
@@ -153,7 +150,7 @@ void ApplicationManager::HandleFetchCallback(
     header->name = "Referer";
     header->value = fetcher->GetRedirectReferer().spec();
     new_request->headers.push_back(header.Pass());
-    params->SetURLInfo(new_request.Pass());
+    params->SetTargetURLRequest(new_request.Pass());
     ConnectToApplication(params.Pass());
     return;
   }
@@ -164,11 +161,8 @@ void ApplicationManager::HandleFetchCallback(
   if (ConnectToRunningApplication(&params))
     return;
 
-  Identity originator_identity = params->originator_identity();
-  CapabilityFilter originator_filter = params->originator_filter();
-  CapabilityFilter filter = params->filter();
-  GURL app_url = params->app_url();
-  std::string qualifier = params->qualifier();
+  Identity source = params->source();
+  Identity target = params->target();
   Shell::ConnectToApplicationCallback connect_callback =
       params->connect_callback();
   params->set_connect_callback(EmptyConnectCallback());
@@ -178,26 +172,25 @@ void ApplicationManager::HandleFetchCallback(
 
   GURL content_handler_url;
   URLResponsePtr new_response;
+  std::string qualifier;
   if (package_manager_->HandleWithContentHandler(fetcher.get(),
-                                                 app_url,
+                                                 target.url(),
                                                  blocking_pool_,
                                                  &new_response,
                                                  &content_handler_url,
                                                  &qualifier)) {
-    LoadWithContentHandler(originator_identity, originator_filter,
-                           content_handler_url, qualifier, filter,
-                           connect_callback, app, request.Pass(),
-                           new_response.Pass());
+    Identity content_handler(content_handler_url, qualifier, target.filter());
+    LoadWithContentHandler(source, content_handler, connect_callback, app,
+                           request.Pass(), new_response.Pass());
   } else {
     // TODO(erg): Have a better way of switching the sandbox on. For now, switch
     // it on hard coded when we're using some of the sandboxable core services.
     bool start_sandboxed = false;
     if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
             switches::kMojoNoSandbox)) {
-      if (app_url == GURL("mojo://core_services/") && qualifier == "Core")
-        start_sandboxed = true;
-      else if (app_url == GURL("mojo://html_viewer/"))
-        start_sandboxed = true;
+      start_sandboxed = (target.url() == GURL("mojo://core_services/") &&
+                            target.qualifier() == "Core") ||
+                        target.url() == GURL("mojo://html_viewer/");
     }
 
     connect_callback.Run(Shell::kInvalidContentHandlerID);
@@ -237,28 +230,23 @@ void ApplicationManager::RunNativeApplication(
 }
 
 void ApplicationManager::LoadWithContentHandler(
-    const Identity& originator_identity,
-    const CapabilityFilter& originator_filter,
-    const GURL& content_handler_url,
-    const std::string& qualifier,
-    const CapabilityFilter& filter,
+    const Identity& source,
+    const Identity& content_handler,
     const Shell::ConnectToApplicationCallback& connect_callback,
     ApplicationInstance* app,
     InterfaceRequest<Application> application_request,
     URLResponsePtr url_response) {
   ContentHandlerConnection* connection = nullptr;
-  Identity content_handler_identity(content_handler_url, qualifier);
   // TODO(beng): Figure out the extent to which capability filter should be
   //             factored into handler identity.
   IdentityToContentHandlerMap::iterator iter =
-      identity_to_content_handler_.find(content_handler_identity);
+      identity_to_content_handler_.find(content_handler);
   if (iter != identity_to_content_handler_.end()) {
     connection = iter->second;
   } else {
     connection = new ContentHandlerConnection(
-        this, originator_identity, originator_filter, content_handler_url,
-        qualifier, filter, ++content_handler_id_counter_);
-    identity_to_content_handler_[content_handler_identity] = connection;
+        this, source, content_handler, ++content_handler_id_counter_);
+    identity_to_content_handler_[content_handler] = connection;
   }
 
   app->set_requesting_content_handler_id(connection->id());
@@ -299,9 +287,7 @@ void ApplicationManager::OnApplicationInstanceError(
 void ApplicationManager::OnContentHandlerConnectionClosed(
     ContentHandlerConnection* content_handler) {
   // Remove the mapping to the content handler.
-  auto it = identity_to_content_handler_.find(
-      Identity(content_handler->content_handler_url(),
-               content_handler->content_handler_qualifier()));
+  auto it = identity_to_content_handler_.find(content_handler->identity());
   DCHECK(it != identity_to_content_handler_.end());
   identity_to_content_handler_.erase(it);
 }
diff --git a/mojo/shell/application_manager.h b/mojo/shell/application_manager.h
index c7ca5dd0a48456..6f93628e638f84 100644
--- a/mojo/shell/application_manager.h
+++ b/mojo/shell/application_manager.h
@@ -117,11 +117,8 @@ class ApplicationManager {
                             bool path_exists);
 
   void LoadWithContentHandler(
-      const Identity& originator_identity,
-      const CapabilityFilter& originator_filter,
-      const GURL& content_handler_url,
-      const std::string& qualifier,
-      const CapabilityFilter& filter,
+      const Identity& source,
+      const Identity& content_handler,
       const Shell::ConnectToApplicationCallback& connect_callback,
       ApplicationInstance* app,
       InterfaceRequest<Application> application_request,
diff --git a/mojo/shell/application_manager_unittest.cc b/mojo/shell/application_manager_unittest.cc
index 8cc0456236a4cc..bc4e2daf6b108c 100644
--- a/mojo/shell/application_manager_unittest.cc
+++ b/mojo/shell/application_manager_unittest.cc
@@ -687,8 +687,7 @@ TEST_F(ApplicationManagerTest, TestEndApplicationClosure) {
 
   bool called = false;
   scoped_ptr<ConnectToApplicationParams> params(new ConnectToApplicationParams);
-  params->SetURLInfo(GURL("test:test"));
-  params->set_filter(GetPermissiveCapabilityFilter());
+  params->SetTargetURL(GURL("test:test"));
   params->set_on_application_end(
       base::Bind(&QuitClosure, base::Unretained(&called)));
   application_manager_->ConnectToApplication(params.Pass());
@@ -716,10 +715,8 @@ TEST(ApplicationManagerTest2, ContentHandlerConnectionGetsRequestorURL) {
 
   bool called = false;
   scoped_ptr<ConnectToApplicationParams> params(new ConnectToApplicationParams);
-  params->set_originator_identity(Identity(requestor_url));
-  params->set_originator_filter(GetPermissiveCapabilityFilter());
-  params->SetURLInfo(GURL("test:test"));
-  params->set_filter(GetPermissiveCapabilityFilter());
+  params->set_source(Identity(requestor_url));
+  params->SetTargetURL(GURL("test:test"));
   params->set_on_application_end(
       base::Bind(&QuitClosure, base::Unretained(&called)));
   application_manager.ConnectToApplication(params.Pass());
@@ -788,10 +785,8 @@ TEST(ApplicationManagerTest2,
     base::RunLoop run_loop;
     scoped_ptr<ConnectToApplicationParams> params(
         new ConnectToApplicationParams);
-    params->set_originator_identity(Identity(requestor_url));
-    params->set_originator_filter(GetPermissiveCapabilityFilter());
-    params->SetURLInfo(GURL("test:test"));
-    params->set_filter(GetPermissiveCapabilityFilter());
+    params->set_source(Identity(requestor_url));
+    params->SetTargetURL(GURL("test:test"));
     params->set_connect_callback([&content_handler_id, &run_loop](uint32_t t) {
       content_handler_id = t;
       run_loop.Quit();
@@ -806,10 +801,8 @@ TEST(ApplicationManagerTest2,
     base::RunLoop run_loop;
     scoped_ptr<ConnectToApplicationParams> params(
         new ConnectToApplicationParams);
-    params->set_originator_identity(Identity(requestor_url));
-    params->set_originator_filter(GetPermissiveCapabilityFilter());
-    params->SetURLInfo(GURL("test:test"));
-    params->set_filter(GetPermissiveCapabilityFilter());
+    params->set_source(Identity(requestor_url));
+    params->SetTargetURL(GURL("test:test"));
     params->set_connect_callback([&content_handler_id2, &run_loop](uint32_t t) {
       content_handler_id2 = t;
       run_loop.Quit();
@@ -846,10 +839,8 @@ TEST(ApplicationManagerTest2, DifferedContentHandlersGetDifferentIDs) {
     base::RunLoop run_loop;
     scoped_ptr<ConnectToApplicationParams> params(
         new ConnectToApplicationParams);
-    params->set_originator_identity(Identity(requestor_url));
-    params->set_originator_filter(GetPermissiveCapabilityFilter());
-    params->SetURLInfo(GURL("test:test"));
-    params->set_filter(GetPermissiveCapabilityFilter());
+    params->set_source(Identity(requestor_url));
+    params->SetTargetURL(GURL("test:test"));
     params->set_connect_callback([&content_handler_id, &run_loop](uint32_t t) {
       content_handler_id = t;
       run_loop.Quit();
@@ -878,10 +869,8 @@ TEST(ApplicationManagerTest2, DifferedContentHandlersGetDifferentIDs) {
     base::RunLoop run_loop;
     scoped_ptr<ConnectToApplicationParams> params(
         new ConnectToApplicationParams);
-    params->set_originator_identity(Identity(requestor_url));
-    params->set_originator_filter(GetPermissiveCapabilityFilter());
-    params->SetURLInfo(GURL("test2:test2"));
-    params->set_filter(GetPermissiveCapabilityFilter());
+    params->set_source(Identity(requestor_url));
+    params->SetTargetURL(GURL("test2:test2"));
     params->set_connect_callback([&content_handler_id2, &run_loop](uint32_t t) {
       content_handler_id2 = t;
       run_loop.Quit();
@@ -901,8 +890,7 @@ TEST_F(ApplicationManagerTest,
 
   uint32_t content_handler_id = 1u;
   scoped_ptr<ConnectToApplicationParams> params(new ConnectToApplicationParams);
-  params->SetURLInfo(GURL("test:test"));
-  params->set_filter(GetPermissiveCapabilityFilter());
+  params->SetTargetURL(GURL("test:test"));
   params->set_connect_callback(
       [&content_handler_id](uint32_t t) { content_handler_id = t; });
   application_manager_->ConnectToApplication(params.Pass());
diff --git a/mojo/shell/capability_filter.cc b/mojo/shell/capability_filter.cc
index be595e0a827702..77cc61d093e5b2 100644
--- a/mojo/shell/capability_filter.cc
+++ b/mojo/shell/capability_filter.cc
@@ -20,7 +20,7 @@ CapabilityFilter GetPermissiveCapabilityFilter() {
 AllowedInterfaces GetAllowedInterfaces(const CapabilityFilter& filter,
                                        const Identity& identity) {
   // Start by looking for interfaces specific to the supplied identity.
-  auto it = filter.find(identity.url.spec());
+  auto it = filter.find(identity.url().spec());
   if (it != filter.end())
     return it->second;
 
diff --git a/mojo/shell/capability_filter.h b/mojo/shell/capability_filter.h
index 2d0ef85442276e..a2a9dfd6325571 100644
--- a/mojo/shell/capability_filter.h
+++ b/mojo/shell/capability_filter.h
@@ -13,7 +13,7 @@
 namespace mojo {
 namespace shell {
 
-struct Identity;
+class Identity;
 
 // A set of names of interfaces that may be exposed to an application.
 using AllowedInterfaces = std::set<std::string>;
diff --git a/mojo/shell/capability_filter_unittest.cc b/mojo/shell/capability_filter_unittest.cc
index 1dbc35b168a3e3..bdb864573d7cb9 100644
--- a/mojo/shell/capability_filter_unittest.cc
+++ b/mojo/shell/capability_filter_unittest.cc
@@ -341,15 +341,11 @@ class CapabilityFilterTest : public testing::Test {
     ServiceProviderPtr exposed_services;
     (new ServiceProviderImpl(GetProxy(&exposed_services)))->
         AddService<Validator>(validator_);
-    URLRequestPtr request(URLRequest::New());
-    request->url = String::From(url);
-
     scoped_ptr<ConnectToApplicationParams> params(
         new ConnectToApplicationParams);
-    params->SetURLInfo(request.Pass());
+    params->SetTarget(Identity(GURL(url), std::string(), filter));
     params->set_services(GetProxy(&services));
     params->set_exposed_services(exposed_services.Pass());
-    params->set_filter(filter);
     params->set_on_application_end(base::MessageLoop::QuitWhenIdleClosure());
     application_manager_->ConnectToApplication(params.Pass());
   }
@@ -402,8 +398,8 @@ class CapabilityFilterTest : public testing::Test {
     CreateLoader<ServiceApplication>("test:service2");
   }
   void TearDown() override {
-    application_manager_.reset();
     test_package_manager_->set_use_test_fetcher(false);
+    application_manager_.reset();
   }
 
  private:
diff --git a/mojo/shell/connect_to_application_params.cc b/mojo/shell/connect_to_application_params.cc
index f1f4f2605c4515..bd0edc2313c7ec 100644
--- a/mojo/shell/connect_to_application_params.cc
+++ b/mojo/shell/connect_to_application_params.cc
@@ -13,27 +13,38 @@ ConnectToApplicationParams::ConnectToApplicationParams() {}
 
 ConnectToApplicationParams::~ConnectToApplicationParams() {}
 
-void ConnectToApplicationParams::SetOriginatorInfo(
-    ApplicationInstance* originator) {
-  if (!originator) {
-    originator_identity_ = Identity();
-    originator_filter_.clear();
+void ConnectToApplicationParams::SetSource(ApplicationInstance* source) {
+  if (!source) {
+    source_ = Identity();
     return;
   }
 
-  originator_identity_ = originator->identity();
-  originator_filter_ = originator->filter();
+  source_ = source->identity();
 }
 
-void ConnectToApplicationParams::SetURLInfo(const GURL& app_url) {
-  app_url_ = app_url;
-  app_url_request_ = URLRequest::New();
-  app_url_request_->url = app_url_.spec();
+void ConnectToApplicationParams::SetTarget(const Identity& target) {
+  target_ = target;
+  target_url_request_ = URLRequest::New();
+  target_url_request_->url = target_.url().spec();
 }
 
-void ConnectToApplicationParams::SetURLInfo(URLRequestPtr app_url_request) {
-  app_url_request_ = app_url_request.Pass();
-  app_url_ = app_url_request_ ? GURL(app_url_request_->url) : GURL();
+void ConnectToApplicationParams::SetTargetURL(const GURL& target_url) {
+  target_ = Identity(target_url, target_.qualifier(), target_.filter());
+  target_url_request_ = URLRequest::New();
+  target_url_request_->url = target_.url().spec();
+}
+
+void ConnectToApplicationParams::SetTargetURLRequest(URLRequestPtr request) {
+  Identity target = request ? Identity(GURL(request->url), target_.qualifier(),
+                                       target_.filter())
+                            : Identity();
+  SetTargetURLRequest(request.Pass(), target);
+}
+
+void ConnectToApplicationParams::SetTargetURLRequest(URLRequestPtr request,
+                                                     const Identity& target) {
+  target_url_request_ = request.Pass();
+  target_ = target;
 }
 
 }  // namespace shell
diff --git a/mojo/shell/connect_to_application_params.h b/mojo/shell/connect_to_application_params.h
index 13268f710a6b70..badca064e3368f 100644
--- a/mojo/shell/connect_to_application_params.h
+++ b/mojo/shell/connect_to_application_params.h
@@ -12,7 +12,6 @@
 #include "mojo/application/public/interfaces/shell.mojom.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
 #include "mojo/services/network/public/interfaces/url_loader.mojom.h"
-#include "mojo/shell/capability_filter.h"
 #include "mojo/shell/identity.h"
 #include "url/gurl.h"
 
@@ -28,35 +27,24 @@ class ConnectToApplicationParams {
   ConnectToApplicationParams();
   ~ConnectToApplicationParams();
 
-  // Sets both |originator_identity_| and |originator_filter_|. If |originator|
-  // is null, both fields are reset.
-  void SetOriginatorInfo(ApplicationInstance* originator);
+  // Sets |source_|. If |source| is null, |source_| is reset.
+  void SetSource(ApplicationInstance* source);
 
-  // Sets both |app_url_| and |app_url_request_|.
-  void SetURLInfo(const GURL& app_url);
-  // Sets both |app_url_| and |app_url_request_|.
-  void SetURLInfo(URLRequestPtr app_url_request);
+  // The following methods set both |target_| and |target_url_request_|.
+  void SetTarget(const Identity& target);
+  void SetTargetURL(const GURL& target_url);
+  void SetTargetURLRequest(URLRequestPtr request);
+  void SetTargetURLRequest(URLRequestPtr request, const Identity& target);
 
-  void set_originator_identity(const Identity& value) {
-    originator_identity_ = value;
-  }
-  const Identity& originator_identity() const { return originator_identity_; }
+  void set_source(const Identity& source) { source_ = source;  }
+  const Identity& source() const { return source_; }
+  const Identity& target() const { return target_; }
 
-  void set_originator_filter(const CapabilityFilter& value) {
-    originator_filter_ = value;
-  }
-  const CapabilityFilter& originator_filter() const {
-    return originator_filter_;
+  const URLRequest* target_url_request() const {
+    return target_url_request_.get();
   }
-
-  const GURL& app_url() const { return app_url_; }
-
-  const URLRequest* app_url_request() const { return app_url_request_.get(); }
-  // NOTE: This doesn't reset |app_url_|.
-  URLRequestPtr TakeAppURLRequest() { return app_url_request_.Pass(); }
-
-  void set_qualifier(const std::string& value) { qualifier_ = value; }
-  const std::string& qualifier() const { return qualifier_; }
+  // NOTE: This doesn't reset |target_|.
+  URLRequestPtr TakeTargetURLRequest() { return target_url_request_.Pass(); }
 
   void set_services(InterfaceRequest<ServiceProvider> value) {
     services_ = value.Pass();
@@ -68,9 +56,6 @@ class ConnectToApplicationParams {
   }
   ServiceProviderPtr TakeExposedServices() { return exposed_services_.Pass(); }
 
-  void set_filter(const CapabilityFilter& value) { filter_ = value; }
-  const CapabilityFilter& filter() const { return filter_; }
-
   void set_on_application_end(const base::Closure& value) {
     on_application_end_ = value;
   }
@@ -87,21 +72,17 @@ class ConnectToApplicationParams {
 
  private:
   // It may be null (i.e., is_null() returns true) which indicates that there is
-  // no originator (e.g., for the first application or in tests).
-  Identity originator_identity_;
-  // Should be ignored if |originator_identity_| is null.
-  CapabilityFilter originator_filter_;
-  // The URL of the application that is being connected to.
-  GURL app_url_;
+  // no source (e.g., for the first application or in tests).
+  Identity source_;
+  // The identity of the application being connected to.
+  Identity target_;
   // The URL request to fetch the application. It may contain more information
-  // than |app_url_| (e.g., headers, request body). When it is taken, |app_url_|
+  // than |target_| (e.g., headers, request body). When it is taken, |target_|
   // remains unchanged.
-  URLRequestPtr app_url_request_;
-  // Please see the comments in identity.h for the exact meaning of qualifier.
-  std::string qualifier_;
+  URLRequestPtr target_url_request_;
+
   InterfaceRequest<ServiceProvider> services_;
   ServiceProviderPtr exposed_services_;
-  CapabilityFilter filter_;
   base::Closure on_application_end_;
   Shell::ConnectToApplicationCallback connect_callback_;
 
diff --git a/mojo/shell/connect_util.cc b/mojo/shell/connect_util.cc
index 0bffc5a49b7f3c..4cdb1dac861fbc 100644
--- a/mojo/shell/connect_util.cc
+++ b/mojo/shell/connect_util.cc
@@ -17,9 +17,9 @@ ScopedMessagePipeHandle ConnectToServiceByName(
     const std::string& interface_name) {
   ServiceProviderPtr services;
   scoped_ptr<ConnectToApplicationParams> params(new ConnectToApplicationParams);
-  params->SetURLInfo(application_url);
+  params->SetTarget(Identity(application_url, std::string(),
+                             GetPermissiveCapabilityFilter()));
   params->set_services(GetProxy(&services));
-  params->set_filter(GetPermissiveCapabilityFilter());
   application_manager->ConnectToApplication(params.Pass());
   MessagePipe pipe;
   services->ConnectToService(interface_name, pipe.handle1.Pass());
diff --git a/mojo/shell/connect_util.h b/mojo/shell/connect_util.h
index 780f7a9f32a18c..8d1a8d63798692 100644
--- a/mojo/shell/connect_util.h
+++ b/mojo/shell/connect_util.h
@@ -21,7 +21,8 @@ ScopedMessagePipeHandle ConnectToServiceByName(
     const std::string& interface_name);
 
 // Must only be used by shell internals and test code as it does not forward
-// capability filters.
+// capability filters. Runs |application_url| with a permissive capability
+// filter.
 template <typename Interface>
 inline void ConnectToService(ApplicationManager* application_manager,
                              const GURL& application_url,
diff --git a/mojo/shell/content_handler_connection.cc b/mojo/shell/content_handler_connection.cc
index 99fbb773844b68..34ae9a9ba1f50a 100644
--- a/mojo/shell/content_handler_connection.cc
+++ b/mojo/shell/content_handler_connection.cc
@@ -14,27 +14,19 @@ namespace shell {
 
 ContentHandlerConnection::ContentHandlerConnection(
     ApplicationManager* manager,
-    const Identity& originator_identity,
-    const CapabilityFilter& originator_filter,
-    const GURL& content_handler_url,
-    const std::string& qualifier,
-    const CapabilityFilter& filter,
+    const Identity& source,
+    const Identity& content_handler,
     uint32_t id)
     : manager_(manager),
-      content_handler_url_(content_handler_url),
-      content_handler_qualifier_(qualifier),
+      identity_(content_handler),
       connection_closed_(false),
       id_(id) {
   ServiceProviderPtr services;
 
   scoped_ptr<ConnectToApplicationParams> params(new ConnectToApplicationParams);
-  params->set_originator_identity(originator_identity);
-  params->set_originator_filter(originator_filter);
-  params->SetURLInfo(content_handler_url);
-  params->set_qualifier(qualifier);
+  params->set_source(source);
+  params->SetTarget(identity_);
   params->set_services(GetProxy(&services));
-  params->set_filter(filter);
-
   manager->ConnectToApplication(params.Pass());
 
   MessagePipe pipe;
diff --git a/mojo/shell/content_handler_connection.h b/mojo/shell/content_handler_connection.h
index bf4f74e3ae712c..b71422f44b7897 100644
--- a/mojo/shell/content_handler_connection.h
+++ b/mojo/shell/content_handler_connection.h
@@ -8,14 +8,14 @@
 #include <string>
 
 #include "mojo/application/public/interfaces/content_handler.mojom.h"
-#include "mojo/shell/capability_filter.h"
+#include "mojo/shell/identity.h"
 #include "url/gurl.h"
 
 namespace mojo {
 namespace shell {
 
 class ApplicationManager;
-struct Identity;
+class Identity;
 
 // A ContentHandlerConnection is responsible for creating and maintaining a
 // connection to an app which provides the ContentHandler service.
@@ -27,29 +27,22 @@ class ContentHandlerConnection {
  public:
   // |id| is a unique identifier for this content handler.
   ContentHandlerConnection(ApplicationManager* manager,
-                           const Identity& originator_identity,
-                           const CapabilityFilter& originator_filter,
-                           const GURL& content_handler_url,
-                           const std::string& qualifier,
-                           const CapabilityFilter& filter,
+                           const Identity& source,
+                           const Identity& content_handler,
                            uint32_t id);
 
   // Closes the connection and destroys |this| object.
   void CloseConnection();
 
   ContentHandler* content_handler() { return content_handler_.get(); }
-  const GURL& content_handler_url() { return content_handler_url_; }
-  const std::string& content_handler_qualifier() {
-    return content_handler_qualifier_;
-  }
+  const Identity& identity() const { return identity_; }
   uint32_t id() const { return id_; }
 
  private:
   ~ContentHandlerConnection();
 
   ApplicationManager* manager_;
-  GURL content_handler_url_;
-  std::string content_handler_qualifier_;
+  Identity identity_;
   ContentHandlerPtr content_handler_;
   bool connection_closed_;
   // The id for this content handler.
diff --git a/mojo/shell/identity.cc b/mojo/shell/identity.cc
index b3d045094ae16f..be74bfbaa40c3e 100644
--- a/mojo/shell/identity.cc
+++ b/mojo/shell/identity.cc
@@ -8,21 +8,51 @@
 
 namespace mojo {
 namespace shell {
+namespace {
+
+// It's valid to specify mojo: URLs in the filter either as mojo:foo or
+// mojo://foo/ - but we store the filter in the latter form.
+CapabilityFilter CanonicalizeFilter(const CapabilityFilter& filter) {
+  CapabilityFilter canonicalized;
+  for (CapabilityFilter::const_iterator it = filter.begin();
+       it != filter.end();
+       ++it) {
+    if (it->first == "*")
+      canonicalized[it->first] = it->second;
+    else
+      canonicalized[GURL(it->first).spec()] = it->second;
+  }
+  return canonicalized;
+}
+
+}  // namespace
 
 Identity::Identity() {}
 
-Identity::Identity(const GURL& in_url, const std::string& in_qualifier)
-    : url(GetBaseURLAndQuery(in_url, nullptr)),
-      qualifier(in_qualifier.empty() ? url.spec() : in_qualifier) {}
+Identity::Identity(const GURL& url)
+    : url_(GetBaseURLAndQuery(url, nullptr)),
+      qualifier_(url_.spec()) {}
+
+Identity::Identity(const GURL& url, const std::string& qualifier)
+    : url_(GetBaseURLAndQuery(url, nullptr)),
+      qualifier_(qualifier.empty() ? url_.spec() : qualifier) {}
+
+Identity::Identity(const GURL& url,
+                   const std::string& qualifier,
+                   CapabilityFilter filter)
+    : url_(GetBaseURLAndQuery(url, nullptr)),
+      qualifier_(qualifier.empty() ? url_.spec() : qualifier),
+      filter_(CanonicalizeFilter(filter)) {}
 
-// explicit
-Identity::Identity(const GURL& in_url)
-    : url(GetBaseURLAndQuery(in_url, nullptr)), qualifier(url.spec()) {}
+Identity::~Identity() {}
 
 bool Identity::operator<(const Identity& other) const {
-  if (url != other.url)
-    return url < other.url;
-  return qualifier < other.qualifier;
+  // We specifically don't include filter in the equivalence check because we
+  // don't quite know how this should work yet.
+  // TODO(beng): figure out how it should work.
+  if (url_ != other.url_)
+    return url_ < other.url_;
+  return qualifier_ < other.qualifier_;
 }
 
 }  // namespace shell
diff --git a/mojo/shell/identity.h b/mojo/shell/identity.h
index f60b2c5061f1be..826ef600dff545 100644
--- a/mojo/shell/identity.h
+++ b/mojo/shell/identity.h
@@ -5,6 +5,7 @@
 #ifndef MOJO_SHELL_IDENTITY_H_
 #define MOJO_SHELL_IDENTITY_H_
 
+#include "mojo/shell/capability_filter.h"
 #include "url/gurl.h"
 
 namespace mojo {
@@ -17,16 +18,33 @@ namespace shell {
 // grouping for a given application URL. For example, the core services are
 // grouped into "Core"/"Files"/"Network"/etc. using qualifier; content handler's
 // qualifier is derived from the origin of the content.
-struct Identity {
+class Identity {
+ public:
   Identity();
-  Identity(const GURL& in_url, const std::string& in_qualifier);
   explicit Identity(const GURL& in_url);
+  Identity(const GURL& in_url, const std::string& in_qualifier);
+  Identity(const GURL& in_url,
+           const std::string& in_qualifier,
+           CapabilityFilter filter);
+  ~Identity();
 
   bool operator<(const Identity& other) const;
-  bool is_null() const { return url.is_empty(); }
-
-  GURL url;
-  std::string qualifier;
+  bool is_null() const { return url_.is_empty(); }
+
+  const GURL& url() const { return url_; }
+  const std::string& qualifier() const { return qualifier_; }
+  const CapabilityFilter& filter() const { return filter_; }
+
+ private:
+  GURL url_;
+  std::string qualifier_;
+
+  // TODO(beng): CapabilityFilter is not currently included in equivalence
+  //             checks for Identity since we're not currently clear on the
+  //             policy for instance disambiguation. Need to figure this out.
+  //             This field is supplied because it is logically part of the
+  //             instance identity of an application.
+  CapabilityFilter filter_;
 };
 
 }  // namespace shell