Reconsider use of --disable-web-security flag by default

[mattcollier]

this flag prevents CORS errors from being thrown in the headless browser. This does not accurately depict real world browser usage. I added this config myself some time ago and it may be overzealous.

https://github.com/digitalbazaar/bedrock-karma/blob/master/lib/config.js#L131