Make DocumentThreadableLoader's cross origin logic clearer in terms of layering

third_party/WebKit/Source/core/fetch/FetchRequest.cpp

 /*
  * Copyright (C) 2012 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 87 matching lines @@
   const bool isSameOriginRequest =
       origin && origin->canRequestNoSuborigin(m_resourceRequest.url());
 
   // Currently FetchRequestMode and FetchCredentialsMode are only used when the
   // request goes to Service Worker.
   m_resourceRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeCORS);
   m_resourceRequest.setFetchCredentialsMode(
       useCredentials ? WebURLRequest::FetchCredentialsModeInclude
                      : WebURLRequest::FetchCredentialsModeSameOrigin);
 
-  m_options.allowCredentials = (isSameOriginRequest || useCredentials)
-                                   ? AllowStoredCredentials
-                                   : DoNotAllowStoredCredentials;
+  if (isSameOriginRequest || useCredentials) {
+    m_options.allowCredentials = AllowStoredCredentials;
+    m_resourceRequest.setAllowStoredCredentials(true);
+  } else {
+    m_options.allowCredentials = DoNotAllowStoredCredentials;
+    m_resourceRequest.setAllowStoredCredentials(false);
+  }
   m_options.corsEnabled = IsCORSEnabled;
   m_options.securityOrigin = origin;
   m_options.credentialsRequested = useCredentials
                                        ? ClientRequestedCredentials
                                        : ClientDidNotRequestCredentials;
 
-  updateRequestForAccessControl(m_resourceRequest, origin,
-                                m_options.allowCredentials);
+  // TODO: Credentials should be removed only when the request is cross origin.
+  m_resourceRequest.removeCredentials();
+
+  if (origin)
+    m_resourceRequest.setHTTPOrigin(origin);
 }
 
 void FetchRequest::setResourceWidth(ResourceWidth resourceWidth) {
   if (resourceWidth.isSet) {
     m_resourceWidth.width = resourceWidth.width;
     m_resourceWidth.isSet = true;
   }
 }
 
 void FetchRequest::setForPreload(bool forPreload, double discoveryTime) {
@@ skipping 24 matching lines @@
   // the dimensions for larger images.
   // TODO(sclittle): Calculate the optimal value for this number.
   m_resourceRequest.setHTTPHeaderField("range", "bytes=0-2047");
 
   // TODO(sclittle): Indicate somehow (e.g. through a new request bit) to the
   // embedder that it should return the full resource if the entire resource is
   // fresh in the cache.
 }
 
 }  // namespace blink