- Electron version: 1.4.1
- Operating system: -

RegisterURLSchemeAsPrivileged sets the scheme's policies to:
- Secure
- Bypassing CSP
- Allowing Service Workers
- Supporting Fetch API
- CORS Enabled

I want all of those except Bypassing CSP. (Correct me if I'm wrong: Bypassing CSP means I couldn't enforce, say, 'object-src none', because that scheme would bypass the object-src policy. If I'm wrong, please LMK -- this may be a non-issue.)

Could we add an options argument to RegisterURLSchemeAsPrivileged for configuring which is enabled? Something like:

``` js
webFrame.registerURLSchemeAsPrivileged('foo', {
  secure: true,
  bypassCSP: false,
  allowServiceWorkers: true,
  supportFetchAPI: true,
  corsEnabled: true
})
```

For backwards compatibility, the flags would default to `true`, so my usecase would be:

``` js
webFrame.registerURLSchemeAsPrivileged('foo', { bypassCSP: false })
```

If 👍 , I'm happy to write a PR.

atom/renderer/api/atom_api_web_frame.cc
blink::WebString privileged_scheme(blink::WebString::fromUTF8(scheme));
  blink::WebSecurityPolicy::registerURLSchemeAsSecure(privileged_scheme);
  blink::WebSecurityPolicy::registerURLSchemeAsBypassingContentSecurityPolicy(
      privileged_scheme);
  blink::WebSecurityPolicy::registerURLSchemeAsAllowingServiceWorkers(
      privileged_scheme);
  blink::WebSecurityPolicy::registerURLSchemeAsSupportingFetchAPI(
      privileged_scheme);
  blink::WebSecurityPolicy::registerURLSchemeAsCORSEnabled(privileged_scheme);
}
void WebFrame::InsertText(const std::string& text) {
  web_frame_->insertText(blink::WebString::fromUTF8(text));
}
void WebFrame::ExecuteJavaScript(const base::string16& code,
                                 mate::Arguments* args) {
  bool has_user_gesture = false;
  args->GetNext(&has_user_gesture);
  ScriptExecutionCallback::CompletionCallback completion_callback;
  args->GetNext(&completion_callback);
  std::unique_ptr<blink::WebScriptExecutionCallback> callback(
      new ScriptExecutionCallback(completion_callback));
  web_frame_->requestExecuteScriptAndReturnValue(
      blink::WebScriptSource(code),
      has_user_gesture,
      callback.release());
}
mate::Handle<WebFrame> WebFrame::Create(v8::Isolate* isolate) {