* Output of `node_modules/.bin/electron --version`: **v4.0.0-beta.3**
* Operating System (Platform and Version): **Windows 10**
* Output of `node_modules/.bin/electron --version` on last known working Electron version (if applicable): **v3.0.4**

**Expected Behavior**
With electron 3, I could pass `webPreferences: {webwebSecurity: false}` to the BrowserWindow constructor (the equivalent of the `--disable-web-security` Chrome command line argument) which would disable CORB (effectively allowing cross-origin requests).

**Actual behavior**
CORB is still doing its thing (ignoring the `{webwebSecurity: false}` option; I see entries like these in the console:
`Cross-Origin Read Blocking (CORB) blocked cross-origin response <URL> with MIME type application/json. See <URL> for more details.`

**To Reproduce**
Make a request (using fetch or xhr) to a file on a different domain.
Example repo:
```
git clone  https://github.com/IAmPicard/electron-cors-repro
npm install
npm run start
```


atom/browser/atom_browser_client.h
bool sandbox = false;
    bool native_window_open = false;
    bool disable_popups = false;
  };
  bool ShouldCreateNewSiteInstance(content::RenderFrameHost* render_frame_host,
                                   content::BrowserContext* browser_context,
                                   content::SiteInstance* current_instance,
                                   const GURL& dest_url);
  void AddProcessPreferences(int process_id, ProcessPreferences prefs);
  void RemoveProcessPreferences(int process_id);
  bool IsProcessObserved(int process_id);
  bool IsRendererSandboxed(int process_id);
  bool RendererUsesNativeWindowOpen(int process_id);
  bool RendererDisablesPopups(int process_id);
  
  std::map<int, content::WebContents*> pending_processes_;
  std::map<int, ProcessPreferences> process_preferences_;
  std::map<int, base::ProcessId> render_process_host_pids_;
  
  std::map<std::string, content::SiteInstance*> site_per_affinities;
  std::unique_ptr<AtomResourceDispatcherHostDelegate>
      resource_dispatcher_host_delegate_;
  std::unique_ptr<PlatformNotificationService> notification_service_;
  std::unique_ptr<NotificationPresenter> notification_presenter_;
  Delegate* delegate_ = nullptr;
  DISALLOW_COPY_AND_ASSIGN(AtomBrowserClient);
};
}  
#endif