Permissive runtime information flow control in the presence of exceptions