Create FormatUrlForSecurityDisplay helper function.

chrome/browser/ui/elide_url.h

Index: chrome/browser/ui/elide_url.h
diff --git a/chrome/browser/ui/elide_url.h b/chrome/browser/ui/elide_url.h
index bd5321a633fbfb5513374903427ca6353be26ada..3685f3d79bd78e718e72f597a0f9cc5bff8522af 100644
--- a/chrome/browser/ui/elide_url.h
+++ b/chrome/browser/ui/elide_url.h
@@ -45,4 +45,24 @@ base::string16 ElideHost(const GURL& host_url,
                          const gfx::FontList& font_list,
                          float available_pixel_width);
 
+// This is a convenience function for formatting a URL as an origin in a concise
+// and human-friendly way. Use this instead of |net::FormatUrl| when the reader
+// needs only to understand the origin (rather than the entire URL).
+//
+// - Omits the path for standard schemes, excepting file and filesystem.
+// - Omits the port if it is the default for the scheme.
+//
+// Do not use this for URLs which will be parsed or sent to other applications.
+//

[msw, 2015/05/29 00:18:51]

nit: remove this blank comment line; the next paragraph meshes with this well.

[palmer, 2015/05/29 17:52:13]

Done.

+// Callers should only set |omit_scheme| to true when it is safe to do so: in
+// contexts where the origin is known to be secure or is always secure by
+// necessity. As examples:

[msw, 2015/05/29 00:18:51]

nit: "For example when GURL::SchemeIsCryptographic() or
content::IsOriginSecure() is true." and then remove the example lines below.

[palmer, 2015/05/29 17:52:13]

Done.

+//
+//   display = FormatOriginForDisplay(url, ..., url.SchemeIsCryptographic());
+//
+//   display = FormatOriginForDisplay(url, ..., IsOriginSecure(url));
+base::string16 FormatOriginForDisplay(const GURL& origin,
+                                      const std::string& languages,
+                                      bool omit_scheme);

[msw, 2015/05/29 00:18:51]

Do we need an |omit_scheme| argument already? Why can't it be determined
automatically based on the scheme security?

[palmer, 2015/05/29 17:52:13]

1. Flexibility. Callers may have different needs.

2. Because the web is not yet at the place where people can safely assume that
"no scheme shown must mean it was a secure scheme". Someday, hopefully soon, but
not yet. In the short term I expect many/most callers to pass false even if
GURL::SchemeIsCryptographic returns true.

+
 #endif  // CHROME_BROWSER_UI_ELIDE_URL_H_