Reject invalid requests with "same-origin" credentials mode

Reject invalid use found in
https://crrev.com/c/chromium/src/+/1695341/.

Bug: 862184
Change-Id: I174d90bec44b8f077168a446b671a76ad38f0317
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1699587
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: David Benjamin <davidben@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#682188}
3 files changed