I've been keeping the whitelist breakout on a branch for some time now, but since this is something that we want to get into Cordova 4.0.0, it will have to be merged in soon.
I've rebased it against master as of this afternoon, and pushed it into a branch - unplug-whitelist-4.0.0 -- It passes all of my tests, but please, if you're involved in the 4.0.x branch, try it out and let me know if it breaks things. I'll merge this in the next little while if I hear only silent approval ;) This should work with the org.apache.cordova.legacy-whitelist to provide functionality identical to previous versions of Cordova.
