You mean like Mason? Possibly you're looking for something more like Catalyst?

These things have been available for Perl for a long time.

But, your window manager doesn't run as root. And themes have to be installed by the end user. This is no less secure that just using a browser.

The overhead could be ridiculous, sure, but this just isn't a security problem.

The REST model is probably a good thing, but HTTP doesn't type your parameters, doesn't allow datastructures more complex than key value pairs, and doesn't do input validation. In most cases where I've seen people using HTTP as a REST mechanism, they end up needing complex data, and end up sending ... *drumroll* ... blocks of XML! Unspec'd, incompatible, app specific XML layouts. SOAP isn't the answer, but it solved some problems very well that HTTP doesn't even approach.