add 'nwdisable' and fix security origin

Fix for rogerwang/node-webkit#534