Restrict transmission of external exp ids to signed in users.

chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/loader/chrome_resource_dispatcher_host_delegate.h"
 
 #include <stdint.h>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 466 matching lines @@
   }
 #endif
 
   // Don't attempt to append headers to requests that have already started.
   // TODO(stevet): Remove this once the request ordering issues are resolved
   // in crbug.com/128048.
   if (!request->is_pending()) {
     net::HttpRequestHeaders headers;
     headers.CopyFrom(request->extra_request_headers());
     bool is_off_the_record = io_data->IsOffTheRecord();
+    bool is_signed_in =
+        !is_off_the_record &&
+        !io_data->google_services_account_id()->GetValue().empty();

[mmenke, 2016/12/09 19:47:44]

I think you just need the last check?  google_services_user_account_id() should
be empty for off the record ProfileIODatas.

[Alexei Svitkine (slow), 2016/12/09 20:10:44]

We don't initialize google_services_account_id for OTR, see:

https://cs.chromium.org/chromium/src/chrome/browser/profiles/profile_io_data....

Not having this would hit a DCHECK that it's not initialized.

     variations::AppendVariationHeaders(
-        request->url(), is_off_the_record,
+        request->url(), is_off_the_record, is_signed_in,
         !is_off_the_record && io_data->GetMetricsEnabledStateOnIOThread(),
         &headers);
     request->SetExtraRequestHeaders(headers);
   }
 
   if (io_data->policy_header_helper())
     io_data->policy_header_helper()->AddPolicyHeaders(request->url(), request);
 
   signin::FixMirrorRequestHeaderHelper(request, GURL() /* redirect_url */,
                                        io_data, info->GetChildID(),
@@ skipping 384 matching lines @@
           base::Bind(&ChromeResourceDispatcherHostDelegate::OnAbortedFrameLoad,
                     base::Unretained(this), url, request_loading_time));
       return;
   }
 
   std::string metric_name = (request_loading_time.InMilliseconds() < 100 ?
       "Net.ErrAborted.Fast" : "Net.ErrAborted.Slow");
   rappor::SampleDomainAndRegistryFromGURL(
       g_browser_process->rappor_service(), metric_name, url);
 }