Access Control for Mobile Agents: the Calculus of Boxed Ambients