[Runtime] WARP security mode should be enabled by default.

According to the W3C widget spec, http://www.w3.org/TR/widgets-access/,
"In the default policy, a user agent must deny access to network resources external to the widget by default, whether this access is requested through APIs (e.g. XMLHttpRequest) or through markup (e.g. iframe, script, img)." Means if there's no access tag in config.xml, all external requests should be blocked.

BUG=XWALK-1772