Fix a deadlock: an OS thread returning from a C call could enter
grabReturnCapability, grabbing the capability that was in the process
of being passed to another thread via passCapability.  This leads to a
deadlock shortly afterward, because the passCapability flag is still
set, so a normal worker won't pick up the capability when it is
released.

Fix (not sure if this is the best fix, though): don't grab the
capability in grabReturnCapability() if passCapabilty is set.