Restrict transmission of external exp ids to signed in users.

components/autofill/core/browser/autofill_download_manager.cc

Index: components/autofill/core/browser/autofill_download_manager.cc
diff --git a/components/autofill/core/browser/autofill_download_manager.cc b/components/autofill/core/browser/autofill_download_manager.cc
index 021a85024ea5a8908a029ff7fe1775f99860e926..a04832dbdd1aca838c9b1f060bacda44c3e81a57 100644
--- a/components/autofill/core/browser/autofill_download_manager.cc
+++ b/components/autofill/core/browser/autofill_download_manager.cc
@@ -247,8 +247,9 @@ bool AutofillDownloadManager::StartRequest(
                         net::LOAD_DO_NOT_SEND_COOKIES);
   // Add Chrome experiment state to the request headers.
   net::HttpRequestHeaders headers;
-  variations::AppendVariationHeaders(
-      fetcher->GetOriginalURL(), driver_->IsOffTheRecord(), false, &headers);
+  variations::AppendVariationHeaders(fetcher->GetOriginalURL(),

[Mathieu, 2016/12/08 18:04:59]

Could we check whether the user is signed in, here? If we don't and pass
|false|, this line is basically a no-op (this class is used to communicate with
a Google server, where an experiment could be activated based on
ClientDataHeader)?

Sorry if I'm not understanding correctly.

[Alexei Svitkine (slow), 2016/12/08 20:27:33]

It shouldn't affect the experiments coming from the variations server, so it
will work as before.

[Mathieu, 2016/12/08 20:37:26]

Thanks for the clarification! Could we add a comment on line 248 about how we
are passing |is_signed_in| as false but that Variations server experiment state
will still be sent?

[Alexei Svitkine (slow), 2016/12/09 15:53:57]

Done.

+                                     driver_->IsOffTheRecord(), false, false,
+                                     &headers);
   fetcher->SetExtraRequestHeaders(headers.ToString());
   fetcher->Start();