Make Android use file:// + replaceState instead of CORS.

Image tests aren't passing on 4.0.3 (but do on 4.3 & 4.4).
Haven't yet removed native side of window.open() hackery.