Add --js-disable-cross-domain-access setting, remove lists of schemes from default.py
Refactor doctos, add reference to --js-disable-cross-domain-access and a note about security