* Output of `node_modules/.bin/electron --version`: **v4.0.0-beta.3**
* Operating System (Platform and Version): **Windows 10**
* Output of `node_modules/.bin/electron --version` on last known working Electron version (if applicable): **v3.0.4**

**Expected Behavior**
With electron 3, I could pass `webPreferences: {webwebSecurity: false}` to the BrowserWindow constructor (the equivalent of the `--disable-web-security` Chrome command line argument) which would disable CORB (effectively allowing cross-origin requests).

**Actual behavior**
CORB is still doing its thing (ignoring the `{webwebSecurity: false}` option; I see entries like these in the console:
`Cross-Origin Read Blocking (CORB) blocked cross-origin response <URL> with MIME type application/json. See <URL> for more details.`

**To Reproduce**
Make a request (using fetch or xhr) to a file on a different domain.
Example repo:
```
git clone  https://github.com/IAmPicard/electron-cors-repro
npm install
npm run start
```


atom/browser/atom_browser_client.cc
content::RenderFrameHost* rfh,
    content::BrowserContext* browser_context,
    const GURL& url,
    bool has_request_started,
    content::SiteInstance* candidate_instance,
    content::SiteInstance** new_instance) {
  if (g_suppress_renderer_process_restart) {
    g_suppress_renderer_process_restart = false;
    return;
  }
  content::SiteInstance* current_instance = rfh->GetSiteInstance();
  if (!ShouldCreateNewSiteInstance(rfh, browser_context, current_instance, url))
    return;
  
  auto* web_contents = content::WebContents::FromRenderFrameHost(rfh);
  auto* web_preferences = WebContentsPreferences::From(web_contents);
  std::string affinity;
  if (web_preferences &&
      web_preferences->GetPreference("affinity", &affinity) &&
      !affinity.empty()) {
    affinity = base::ToLowerASCII(affinity);
    auto iter = site_per_affinities.find(affinity);
    GURL dest_site = content::SiteInstance::GetSiteForURL(browser_context, url);
    if (iter != site_per_affinities.end() &&