Origin header should be preserved in http requests made via OpenURL code path.

third_party/WebKit/LayoutTests/http/tests/navigation/resources/form-target.pl

Index: third_party/WebKit/LayoutTests/http/tests/navigation/resources/form-target.pl
diff --git a/third_party/WebKit/LayoutTests/http/tests/navigation/resources/form-target.pl b/third_party/WebKit/LayoutTests/http/tests/navigation/resources/form-target.pl
index c07187d0ea0ed920b2201166b8e1b3b3227c8f83..17ccd01f360d9ba7d2132d235996c95ec9cdaa3f 100755
--- a/third_party/WebKit/LayoutTests/http/tests/navigation/resources/form-target.pl
+++ b/third_party/WebKit/LayoutTests/http/tests/navigation/resources/form-target.pl
@@ -24,6 +24,22 @@ foreach $paramName (@paramNames)
     print "<li>" . $paramName . " = " . $query->param($paramName) . "</li>"
 }
 
+print <<HEADER2;

[jww, 2016/08/09 22:38:23]

There are a lot of tests that use form-target.pl, and you'll need to change the
test expectations for all of them if you do this, I think. For exmaple,
"form-action-src-allowed.html" uses this target. Instead, maybe add a parameter
to form-target.pl that gets the header printing. Maybe only print if the request
is to "form-target.pl?print-headers=true"?

[Łukasz Anforowicz, 2016/08/10 00:03:19]

Ooops.  I thought that I fixed expectations of all the affected tests, but
obviously I've missed tests outside of http/tests/navigation.

I thought about making the headers dump optional, but decided against it because
of worries about the interaction with forms using get method.  I also like the
extra coverage provided by the dumping of the headers from other testcases (e.g.
previously we could start sending Origin with GET requests and the existing
tests wouldn't have caught this).

Would it be okay if I just updated test expectations for the 3 affected tests
under http/tests/security/contentSecurityPolicy/1.1?  This is what I am doing in
patchset 4.  (if this is not okay not, then I think I also could 1) modify
changes to form-target.pl so we only dump headers if a query parameter is
present and 2) modify changes to form-targets-cross-site-frame-post.html so it
is the only layout test that asks for dump of http request headers).

WDYT?

[jww, 2016/08/10 00:44:53]

SGTM. If it's just the CSP tests using this, that's esp. fine, since it probably
behooves them to verify the headers as well. I'm a big fan of providing options
to test resources like this, but I appreciate your concerns about forms using
the GET method.

+</ul>
+<p>Http headers:</p>
+<ul>
+HEADER2
+
+my %headers = map { $_ => $query->http($_) } $query->http();
+for my $header ( sort (keys %headers) ) {
+    if (("$header" ne "HTTP_ACCEPT_ENCODING") &&
+        ("$header" ne "HTTP_ACCEPT_LANGUAGE") &&
+        ("$header" ne "HTTP_ACCEPT") &&
+        ("$header" ne "HTTP_USER_AGENT")) {
+        print "<li>$header = $headers{$header}</li>\n";
+    }
+}
+
 print <<FOOTER
 </ul>
 <script>