red.cgehq.net, but the login form inside the iframe
belongs to blue.cgehq.net. Chrome provides cross-origin
context in the AssistStructure. Android autofill providers
shoud NOT offer to fill blue.cgehq.net credentials without
a confirmation dialog.