If easy sign-in is set up, allow TPMTokenLoader to start before login

chrome/browser/profiles/profile_io_data.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/profile_io_data.h"
 
 #include <string>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
@@ skipping 413 matching lines @@
                                          profile->GetPath()));
 
       // Use the device-wide system key slot only if the user is of the same
       // domain as the device is registered to.
       policy::BrowserPolicyConnectorChromeOS* connector =
           g_browser_process->platform_part()
               ->browser_policy_connector_chromeos();
       params->use_system_key_slot =
           connector->GetUserAffiliation(user->email()) ==
           policy::USER_AFFILIATION_MANAGED;
+    } else {
+      params->use_system_key_slot =

[pneubeck (no reviews), 2014/12/02 11:56:47]

use_system_key_slot=true has two effects:
 - trigger initialization of the system token
(EnableNSSSystemKeySlotForResourceContext)
 - use the system token's certs in the ClientCertStoreChromeOS

I'm rather sure that you want only the first and not the second behavior.
You might have to split use_system_key_slot into two more fine-grained flags.

+          chromeos::ProfileHelper::IsSigninProfile(profile);
     }
   }
 #endif
 
   params->profile = profile;
   params->prerender_tracker = g_browser_process->prerender_tracker();
   profile_params_.reset(params.release());
 
   ChromeNetworkDelegate::InitializePrefsOnUIThread(
       &enable_referrers_,
@@ skipping 859 matching lines @@
 void ProfileIOData::SetCookieSettingsForTesting(
     CookieSettings* cookie_settings) {
   DCHECK(!cookie_settings_.get());
   cookie_settings_ = cookie_settings;
 }
 
 void ProfileIOData::set_signin_names_for_testing(
     SigninNamesOnIOThread* signin_names) {
   signin_names_.reset(signin_names);
 }