Be more strict about accepting SAML passwords

Be more strict about accepting SAML passwords

When a Chrome OS user authenticates via SAML, we have to extracts
the password from the IdP's login form(s). Since the auth flow can
span multiple pages, we need to collect potential passwords from all
those pages. However, if we see the same page again, we should assume
that the user went backwards in the flow or typed the wrong password
and any password typed into the second instance of a page should
overwrite the one we extracted from the first instance.

We used to check whether we are on the same page again by comparing
entire URLs. With this CL, we strip the query string and anchor, thus
looking at the protocol, host, port and path only.

BUG=476511
TEST=Manual, with crosdev1.biz

Review URL: https://codereview.chromium.org/1092933002

Cr-Commit-Position: refs/heads/master@{#325652}