I am not sure that is is a good idea to put such devices in a special class of their own. It risks giving devices permissions and trust that they don't actuall

I am not sure that is is a good idea to put such devices in a special class of their own. It risks giving devices permissions and trust that they don't actually deserve. Better to treat them as an internet server and use existing procotols (OAuth, CORS, TLS, WebSockets etc.). As far as I know all those protocols work perfectly well on a local network behind a NAT. More importantly browsers already have well understood restrictions to prevent XSS built in.