HTML Imports: Send credentials for same origin requests

Source/core/html/imports/HTMLImportsController.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 68 matching lines @@
 HTMLImportChild* HTMLImportsController::load(HTMLImport* parent, HTMLImportChildClient* client, FetchRequest request)
 {
     ASSERT(!request.url().isEmpty() && request.url().isValid());
 
     if (findLinkFor(request.url())) {
         HTMLImportChild* child = createChild(request.url(), parent, client);
         child->wasAlreadyLoaded();
         return child;
     }
 
-    request.setCrossOriginAccessControl(securityOrigin(), DoNotAllowStoredCredentials);
+    bool sameOriginRequest = securityOrigin()->canRequest(request.url());
+    request.setCrossOriginAccessControl(
+        securityOrigin(), sameOriginRequest ? AllowStoredCredentials : DoNotAllowStoredCredentials,
+        ClientDidNotRequestCredentials);
     ResourcePtr<RawResource> resource = parent->document()->fetcher()->fetchImport(request);
     if (!resource)
         return 0;
 
     HTMLImportChild* child = createChild(request.url(), parent, client);
     // We set resource after the import tree is built since
     // Resource::addClient() immediately calls back to feed the bytes when the resource is cached.
     child->startLoading(resource);
 
     return child;
@@ skipping 59 matching lines @@
 
 void HTMLImportsController::recalcTimerFired(Timer<HTMLImportsController>*)
 {
     do {
         m_recalcTimer.stop();
         HTMLImport::recalcTreeState(this);
     } while (m_recalcTimer.isActive());
 }
 
 } // namespace WebCore