[Runtime] WARP security mode should be enabled by default.

According to the W3C widget spec, http://www.w3.org/TR/widgets-access/,
the WARP mode need to be enabled by default, means if there's no access
tag in config.xml, all external requests should be blocked.

BUG=XWALK-1772