Implement the "first-party-only" cookie flag.

net/url_request/url_request_http_job.cc

Index: net/url_request/url_request_http_job.cc
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index 098ef85e8310e678b4b6314ed9f22b208b6ae219..5c78e1725c02ffbef2782047a8249c32ccafe714 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -629,6 +629,12 @@ void URLRequestHttpJob::AddCookieHeaderAndStart() {
 void URLRequestHttpJob::DoLoadCookies() {
   CookieOptions options;
   options.set_include_httponly();
+  options.set_include_first_party_only();
+
+  // TODO(mkwst): Pipe a switch down here to allow us to decide whether we
+  // should enforce "first-party only" cookies or not (by setting |options|'s
+  // first-party-url to the first-party-for-cookies value. crbug.com/459154
+
   GetCookieStore()->GetCookiesWithOptionsAsync(
       request_->url(), options,
       base::Bind(&URLRequestHttpJob::OnCookiesLoaded,