cros: Add a header for gaia auth requests.

chrome/browser/resources/gaia_auth/manifest.json

 {
   // chrome-extension://mfffpogegjflfpflabcdkioaeobkgjik/
   "key": "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC4L17nAfeTd6Xhtx96WhQ6DSr8KdHeQmfzgCkieKLCgUkWdwB9G1DCuh0EPMDn1MdtSwUAT7xE36APEzi0X/UpKjOVyX8tCC3aQcLoRAE0aJAvCcGwK7qIaQaczHmHKvPC2lrRdzSoMMTC5esvHX+ZqIBMi123FOL0dGW6OPKzIwIBIw==",
   "name": "GaiaAuthExtension",
   "version": "0.0.1",
   "manifest_version": 2,
   "content_security_policy": "default-src 'self'; script-src 'self'; frame-src *; style-src 'self' 'unsafe-inline'",

[asargent_no_longer_on_chrome, 2013/04/12 17:46:07]

Do we really need unsafe-inline here?

[xiyuan, 2013/04/12 18:05:00]

Removed. CSS rules are moved out of the html already.

   "description": "GAIA Component Extension",
   "web_accessible_resources": [
     "main.css",
     "main.html",
     "main.js",
     "offline.css",
     "offline.html",
     "offline.js",
     "success.html",
     "success.js",
     "util.js"
   ],
-  // cookies for getting hash passed back from GAIA on login success
-  // tabs for calling current webui's login. This might not be needed once
-  //     we have extension API
+  "background": {
+    "scripts": ["background.js"]

[asargent_no_longer_on_chrome, 2013/04/12 17:46:07]

Can you make this use event pages (aka "lazy background pages" aka
"persistent":false)? 

https://developer.chrome.com/extensions/event_pages.html

[xiyuan, 2013/04/12 18:05:00]

webRequest is not supported in event pages yet.

+  },
+  // background, webRequest and host rules to set additional http header for
+  //     request sent from sub frame.
   "permissions": [
-      "cookies",
-      "tabs",
-      "chrome://oobe/"
+    "background",
+    "webRequest",
+    "webRequestBlocking",
+    "<all_urls>"

[zel, 2013/04/11 20:43:21]

Can't we scope this down from <all_urls>? This seems too permissive to me.

   ]
 }