I think the whole NaCL thing was able to do the ssh directly from the browser without any tunneling, but maybe I am misremembering