* Output of `node_modules/.bin/electron --version`: **v4.0.0-beta.3**
* Operating System (Platform and Version): **Windows 10**
* Output of `node_modules/.bin/electron --version` on last known working Electron version (if applicable): **v3.0.4**

**Expected Behavior**
With electron 3, I could pass `webPreferences: {webwebSecurity: false}` to the BrowserWindow constructor (the equivalent of the `--disable-web-security` Chrome command line argument) which would disable CORB (effectively allowing cross-origin requests).

**Actual behavior**
CORB is still doing its thing (ignoring the `{webwebSecurity: false}` option; I see entries like these in the console:
`Cross-Origin Read Blocking (CORB) blocked cross-origin response <URL> with MIME type application/json. See <URL> for more details.`

**To Reproduce**
Make a request (using fetch or xhr) to a file on a different domain.
Example repo:
```
git clone  https://github.com/IAmPicard/electron-cors-repro
npm install
npm run start
```


atom/browser/atom_browser_client.cc
const GURL& url,
    const content::ResourceRequestInfo::WebContentsGetter& web_contents_getter,
    bool has_user_gesture) {
  content::WebContents* web_contents = web_contents_getter.Run();
  if (!web_contents)
    return;
  auto* permission_helper =
      WebContentsPermissionHelper::FromWebContents(web_contents);
  if (!permission_helper)
    return;
  GURL escaped_url(net::EscapeExternalHandlerValue(url.spec()));
  auto callback = base::Bind(&OnOpenExternal, escaped_url);
  permission_helper->RequestOpenExternalPermission(callback, has_user_gesture,
                                                   url);
}
bool AtomBrowserClient::HandleExternalProtocol(
    const GURL& url,
    content::ResourceRequestInfo::WebContentsGetter web_contents_getter,
    int child_id,
    content::NavigationUIData* navigation_data,
    bool is_main_frame,
    ui::PageTransition page_transition,
    bool has_user_gesture) {
  BrowserThread::PostTask(
      BrowserThread::UI, FROM_HERE,
      base::BindOnce(&HandleExternalProtocolInUI, url, web_contents_getter,
                     has_user_gesture));
  return true;
}
std::vector<std::unique_ptr<content::NavigationThrottle>>