function deleteCap (origin, capUrl) {
  var token = extractToken(capUrl)
  if (!token) throw new Error('Invalid capability URL')
  var capIndex = capabilities.findIndex(c => c.token === token)
  if (capIndex === -1) throw new Error('Capability does not exist')
  
  if (capabilities[capIndex].owningOrigin !== origin) {
    throw new PermissionsError('Cannot modify unowned capability')
  }
  
  capabilities.splice(capIndex, 1)
}
@param {String} origin
@param {String} capUrl
@returns {Void}