* Output of `node_modules/.bin/electron --version`: **v4.0.0-beta.3**
* Operating System (Platform and Version): **Windows 10**
* Output of `node_modules/.bin/electron --version` on last known working Electron version (if applicable): **v3.0.4**

**Expected Behavior**
With electron 3, I could pass `webPreferences: {webwebSecurity: false}` to the BrowserWindow constructor (the equivalent of the `--disable-web-security` Chrome command line argument) which would disable CORB (effectively allowing cross-origin requests).

**Actual behavior**
CORB is still doing its thing (ignoring the `{webwebSecurity: false}` option; I see entries like these in the console:
`Cross-Origin Read Blocking (CORB) blocked cross-origin response <URL> with MIME type application/json. See <URL> for more details.`

**To Reproduce**
Make a request (using fetch or xhr) to a file on a different domain.
Example repo:
```
git clone  https://github.com/IAmPicard/electron-cors-repro
npm install
npm run start
```


atom/browser/atom_browser_client.cc
const scoped_refptr<network::ResourceRequestBody>& body,
    bool user_gesture,
    bool opener_suppressed,
    bool* no_javascript_access) {
  DCHECK_CURRENTLY_ON(BrowserThread::UI);
  int opener_render_process_id = opener->GetProcess()->GetID();
  if (IsRendererSandboxed(opener_render_process_id)) {
    *no_javascript_access = false;
    return true;
  }
  if (RendererUsesNativeWindowOpen(opener_render_process_id)) {
    if (RendererDisablesPopups(opener_render_process_id)) {
      
      
      return false;
    } else {
      *no_javascript_access = false;
      return true;
    }
  }
  if (delegate_) {
    return delegate_->CanCreateWindow(
        opener, opener_url, opener_top_level_frame_url, source_origin,
        container_type, target_url, referrer, frame_name, disposition, features,
        additional_features, body, user_gesture, opener_suppressed,
        no_javascript_access);
  }
  return false;
}
void AtomBrowserClient::GetAdditionalAllowedSchemesForFileSystem(