Having it without a prompt is also not a acceptable situation.

I think HTML should be split in web sites, and applications. If a page wants to use the camera, or vibration, etc., it should take you to "Programs & Features" or the Apps settings and say:

"This website XXX is a program, not a page. Do you want to install this program?"

I would even consider make the list of "programs" visible at all times on the edge of the last start screen page, and limit it to 12 programs or so, in order to prevent people from installing all kinds of junk.