Carve out an exception for embedded credentials in XHR.

third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

Index: third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp b/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
index c76c035d6a8a55018be956d5d2a2b08e98bcf51d..fee40156b61d366ca25a0262b3b13c9b62e2951e 100644
--- a/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
@@ -833,7 +833,10 @@ ResourceRequestBlockedReason FrameFetchContext::CanRequestInternal(
       if (RuntimeEnabledFeatures::blockLegacySubresourcesEnabled())
         return ResourceRequestBlockedReason::kOrigin;
     }
-    if (!url.User().IsEmpty() || !url.Pass().IsEmpty()) {
+
+    if ((!url.User().IsEmpty() || !url.Pass().IsEmpty()) &&
+        resource_request.GetRequestContext() !=
+            WebURLRequest::kRequestContextXMLHttpRequest) {
       Deprecation::CountDeprecation(
           GetFrame()->GetDocument(),
           UseCounter::kRequestedSubresourceWithEmbeddedCredentials);