[Android] Disable CORS for file:// schemes.

Cross-Origin request breaks the web security policy, only same-origin
request should be allowed for file:// schemes, so universal access
from file URLs should be closed.

BUG=https://github.com/crosswalk-project/crosswalk/issues/790
Merge pull request #791 from gaochun/permission_control

[Android] Disable Cross-Origin request by default.