Restrict transmission of external exp ids to signed in users.

Restrict transmission of external exp ids to signed in users.

Since external experiment ids are not based on Chrome's low
entropy source, they do not have the same guarantees about
not identifying a user as Chrome's variations. As such, we
should only transmit them for signed in users, whose identity
is already known by Google so there's no risk of identifying
them through these headers.

Note: The signed-in state checking in this CL is only done for
web content area requests and not other internal requests,
like to the suggestion service, where it treats the state as
"not signed in". This is fine to do because variations service
ids are still sent, which is what the other call sites are
interested in.

BUG=672532
TBR=mpearson@chromium.org,mattm@chromium.org,donnd@chromium.org,afakhry@chromium.org

Review-Url: https://codereview.chromium.org/2558913003
Cr-Commit-Position: refs/heads/master@{#437959}
(cherry picked from commit 9ed7b5611a61505c3dba734fe55b92211df3c2f6)

[Alexei Svitkine (slow), 2016-12-14 17:55:45]

Committed patchset #1 (id:1) to pending queue manually as
ef1bff325b16363dd94b812468be190b039c82e5 (tree was closed).

[Alexei Svitkine (slow), 2016-12-14 17:58:03]

A revert of this CL (patchset #1 id:1) has been created in
https://codereview.chromium.org/2576733002/ by asvitkine@chromium.org.

The reason for reverting is: Merge conflict error..