Restrict transmission of external exp ids to signed in users.

chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc

Index: chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
diff --git a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
index a2f943e4c801cb410424d447e87c0e70912f6476..cf29ee83585bdbbe9eb1b7b9cf26d75ca586448c 100644
--- a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
+++ b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
@@ -484,8 +484,11 @@ void ChromeResourceDispatcherHostDelegate::RequestBeginning(
     net::HttpRequestHeaders headers;
     headers.CopyFrom(request->extra_request_headers());
     bool is_off_the_record = io_data->IsOffTheRecord();
+    bool is_signed_in =
+        !is_off_the_record &&
+        !io_data->google_services_account_id()->GetValue().empty();

[mmenke, 2016/12/09 19:47:44]

I think you just need the last check?  google_services_user_account_id() should
be empty for off the record ProfileIODatas.

[Alexei Svitkine (slow), 2016/12/09 20:10:44]

We don't initialize google_services_account_id for OTR, see:

https://cs.chromium.org/chromium/src/chrome/browser/profiles/profile_io_data....

Not having this would hit a DCHECK that it's not initialized.

     variations::AppendVariationHeaders(
-        request->url(), is_off_the_record,
+        request->url(), is_off_the_record, is_signed_in,
         !is_off_the_record && io_data->GetMetricsEnabledStateOnIOThread(),
         &headers);
     request->SetExtraRequestHeaders(headers);