The opposite is true. Virtually no web auth systems are capability based. Maybe security SaaS providers are using it, but relatively spreading, they're not representative of the web proper.