* Output of `node_modules/.bin/electron --version`: **v4.0.0-beta.3**
* Operating System (Platform and Version): **Windows 10**
* Output of `node_modules/.bin/electron --version` on last known working Electron version (if applicable): **v3.0.4**

**Expected Behavior**
With electron 3, I could pass `webPreferences: {webwebSecurity: false}` to the BrowserWindow constructor (the equivalent of the `--disable-web-security` Chrome command line argument) which would disable CORB (effectively allowing cross-origin requests).

**Actual behavior**
CORB is still doing its thing (ignoring the `{webwebSecurity: false}` option; I see entries like these in the console:
`Cross-Origin Read Blocking (CORB) blocked cross-origin response <URL> with MIME type application/json. See <URL> for more details.`

**To Reproduce**
Make a request (using fetch or xhr) to a file on a different domain.
Example repo:
```
git clone  https://github.com/IAmPicard/electron-cors-repro
npm install
npm run start
```


atom/browser/atom_browser_client.cc
std::vector<std::string>* additional_schemes) {
  auto schemes_list = api::GetStandardSchemes();
  if (!schemes_list.empty())
    additional_schemes->insert(additional_schemes->end(), schemes_list.begin(),
                               schemes_list.end());
  additional_schemes->push_back(content::kChromeDevToolsScheme);
}
void AtomBrowserClient::GetAdditionalWebUISchemes(
    std::vector<std::string>* additional_schemes) {
  additional_schemes->push_back(content::kChromeDevToolsScheme);
}
void AtomBrowserClient::SiteInstanceDeleting(
    content::SiteInstance* site_instance) {
  
  
  for (auto iter = site_per_affinities.begin();
       iter != site_per_affinities.end(); ++iter) {
    if (iter->second == site_instance) {
      site_per_affinities.erase(iter);
      break;
    }
  }
}
std::unique_ptr<net::ClientCertStore> AtomBrowserClient::CreateClientCertStore(