cros: Add a header for gaia auth requests.

cros: Add a header for gaia auth requests.

- Add background handler to gaia auth to add a http header
  "X-Origin: Cros-Auth-Ext"  for all requests in gaia sub frame;
- Load gaia auth extension on web ui login creation and unload it
  when the login view is gone;

BUG=230415

[xiyuan, 2013-04-11 19:50:39]

asargent please review extensions/*
zel please review all files

[zel, 2013-04-11 20:43:20]

https://codereview.chromium.org/13872010/diff/1/chrome/browser/resources/gaia...
File chrome/browser/resources/gaia_auth/manifest.json (right):

https://codereview.chromium.org/13872010/diff/1/chrome/browser/resources/gaia...
chrome/browser/resources/gaia_auth/manifest.json:29: "<all_urls>"
Can't we scope this down from <all_urls>? This seems too permissive to me.

[asargent_no_longer_on_chrome, 2013-04-12 17:46:06]

https://codereview.chromium.org/13872010/diff/1/chrome/browser/resources/gaia...
File chrome/browser/resources/gaia_auth/manifest.json (right):

https://codereview.chromium.org/13872010/diff/1/chrome/browser/resources/gaia...
chrome/browser/resources/gaia_auth/manifest.json:7: "content_security_policy":
"default-src 'self'; script-src 'self'; frame-src *; style-src 'self'
'unsafe-inline'",
Do we really need unsafe-inline here?

https://codereview.chromium.org/13872010/diff/1/chrome/browser/resources/gaia...
chrome/browser/resources/gaia_auth/manifest.json:21: "scripts":
["background.js"]
Can you make this use event pages (aka "lazy background pages" aka
"persistent":false)? 

https://developer.chrome.com/extensions/event_pages.html

[xiyuan, 2013-04-12 18:05:00]

Permissions issue is still under discussion.
Will ping back once it is settled.

https://codereview.chromium.org/13872010/diff/1/chrome/browser/resources/gaia...
File chrome/browser/resources/gaia_auth/manifest.json (right):

https://codereview.chromium.org/13872010/diff/1/chrome/browser/resources/gaia...
chrome/browser/resources/gaia_auth/manifest.json:7: "content_security_policy":
"default-src 'self'; script-src 'self'; frame-src *; style-src 'self'
'unsafe-inline'",
On 2013/04/12 17:46:07, Antony Sargent wrote:
> Do we really need unsafe-inline here?
> 

Removed. CSS rules are moved out of the html already.

https://codereview.chromium.org/13872010/diff/1/chrome/browser/resources/gaia...
chrome/browser/resources/gaia_auth/manifest.json:21: "scripts":
["background.js"]
On 2013/04/12 17:46:07, Antony Sargent wrote:
> Can you make this use event pages (aka "lazy background pages" aka
> "persistent":false)? 
> 
> https://developer.chrome.com/extensions/event_pages.html
> 
> 

webRequest is not supported in event pages yet.

[Nikita (slow), 2013-04-15 15:49:26]

https://codereview.chromium.org/13872010/diff/5001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/webui_login_view.cc (right):

https://codereview.chromium.org/13872010/diff/5001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/webui_login_view.cc:203: Profile* profile =
ProfileManager::GetDefaultProfile();
Depending on which CL lands first, this has to be merged with
https://codereview.chromium.org/13633003/

[Nikita (slow), 2013-04-19 11:35:57]

https://codereview.chromium.org/13872010/diff/5001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/webui_login_view.cc (right):

https://codereview.chromium.org/13872010/diff/5001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/webui_login_view.cc:152:
component_loader->Add(IDR_GAIA_AUTH_MANIFEST,
Is ComponentLoader just fine with postponed initialization?

https://codereview.chromium.org/13872010/diff/5001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/webui_login_view.cc:161: Profile* profile_;
nit: // Not owned.

https://codereview.chromium.org/13872010/diff/5001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/webui_login_view.cc:203: Profile* profile =
ProfileManager::GetDefaultProfile();
On 2013/04/15 15:49:27, Nikita Kostylev wrote:
> Depending on which CL lands first, this has to be merged with
> https://codereview.chromium.org/13633003/

CL landed, this should be ProfileHelper::GetSigninProfile() now.

https://codereview.chromium.org/13872010/diff/5001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/webui_login_view.h (right):

https://codereview.chromium.org/13872010/diff/5001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/webui_login_view.h:165:
scoped_ptr<ScopedGaiaAuthExtension> gaia_auth_;
nit: gaia_auth_ext_