Disable Cross-Origin request by default.

Cross-Origin request breaks the web security policy, only same-origin
request could be allowed by default.

BUG=https://github.com/crosswalk-project/crosswalk/issues/790