fix #4913

Auditors: @bridiver

Test Plan:
1. open about:preferences and open devtools
2. the top-level HTTP response should not show an 'Access-Control-Allow-Origin' header