OOR-CORS: strip username and password in CORSURLLoader

In the legacy Blink CORS, these information are stripped in
DocumentThreadableLoader in MakeCrossOriginAccessRequest().

Current OOR-CORS implementation only has DCHECKS for them,
but hasn't stripped.

Bug: 803766
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo
Change-Id: If1a4657804215a8ce9a302acb658f9407348a79a
Reviewed-on: https://chromium-review.googlesource.com/999672
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#551621}
3 files changed