CrossOriginAccessControl: separate access checks and error message generation

The checking and construction of legible error messages can with benefit
be separated, having the security access checks return an error status
which then can be used to generate a suitable error message.

Along with separating the two, switch to using StringBuilders.

R=
BUG=

Review-Url: https://codereview.chromium.org/2616323002
Cr-Commit-Position: refs/heads/master@{#442236}
7 files changed