Restrict transmission of external exp ids to signed in users.

components/autofill/core/browser/autofill_download_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/core/browser/autofill_download_manager.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/location.h"
@@ skipping 229 matching lines @@
       fetcher, data_use_measurement::DataUseUserData::AUTOFILL);
   url_fetchers_[fetcher] =
       std::make_pair(std::move(owned_fetcher), request_data);
   fetcher->SetAutomaticallyRetryOn5xx(false);
   fetcher->SetRequestContext(request_context);
   fetcher->SetUploadData("text/proto", request_data.payload);
   fetcher->SetLoadFlags(net::LOAD_DO_NOT_SAVE_COOKIES |
                         net::LOAD_DO_NOT_SEND_COOKIES);
   // Add Chrome experiment state to the request headers.
   net::HttpRequestHeaders headers;
-  variations::AppendVariationHeaders(
-      fetcher->GetOriginalURL(), driver_->IsOffTheRecord(), false, &headers);
+  // Note: It's fine to pass in |is_signed_in| false, which does not affect
+  // transmission of experiment ids coming from the variations server.
+  bool is_signed_in = false;
+  variations::AppendVariationHeaders(fetcher->GetOriginalURL(),
+                                     driver_->IsOffTheRecord(), false,
+                                     is_signed_in, &headers);
   fetcher->SetExtraRequestHeaders(headers.ToString());
   fetcher->Start();
 
   return true;
 }
 
 void AutofillDownloadManager::CacheQueryRequest(
     const std::vector<std::string>& forms_in_query,
     const std::string& query_data) {
   std::string signature = GetCombinedSignature(forms_in_query);
@@ skipping 84 matching lines @@
                                            it->second.second.form_signatures);
     } else {
       VLOG(1) << "AutofillDownloadManager: upload request has succeeded.";
       observer_->OnUploadedPossibleFieldTypes();
     }
   }
   url_fetchers_.erase(it);
 }
 
 }  // namespace autofill