Clean up the CORS preflight part of DocumentThreadableLoader::MakeCrossOriginAccessRequest()

The bunch of if-clauses are hard to read. Reorganize them for better
readability.

Unify the multiple checks on IsExternalRequest.

Early return for IsExternalRequest().

Don't check CORS-safelisted-ness when either of the external request or
forced preflight condition is already met.

Clarify where the ServiceWorkerMode configuration is required and its
reason for each place.

Bug: 695808, 604084
Change-Id: I2a056afeebea4d6472e60c52cc72fd58c6bef703
Reviewed-on: https://chromium-review.googlesource.com/542676Reviewed-by: Tsuyoshi Horo <horo@chromium.org>
Commit-Queue: Takeshi Yoshino <tyoshino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#481846}

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h

@@ -136,9 +136,12 @@ class CORE_EXPORT DocumentThreadableLoader final : public ThreadableLoader,
   void MakeCrossOriginAccessRequest(const ResourceRequest&);
   // Loads m_fallbackRequestForServiceWorker.
   void LoadFallbackRequestForServiceWorker();
-  // Loads m_actualRequest.
+  // Issues a CORS preflight.
+  void LoadPreflightRequest(const ResourceRequest&,
+                            const ResourceLoaderOptions&);
+  // Loads actual_request_.
   void LoadActualRequest();
-  // Clears m_actualRequest and reports access control check failure to
+  // Clears actual_request_ and reports access control check failure to
   // m_client.
   void HandlePreflightFailure(const String& url,
                               const String& error_description);
@@ -152,7 +155,8 @@ class CORE_EXPORT DocumentThreadableLoader final : public ThreadableLoader,
   void LoadRequestAsync(const ResourceRequest&, ResourceLoaderOptions);
   void LoadRequestSync(const ResourceRequest&, ResourceLoaderOptions);
 
-  void PrepareCrossOriginRequest(ResourceRequest&);
+  void PrepareCrossOriginRequest(ResourceRequest&) const;
+
   // This method modifies the ResourceRequest by calling
   // SetAllowStoredCredentials() on it based on same-origin-ness and the
   // credentials mode.