We assume that a UKMSourceID is created and tied to URL when the PasswordFormMetricsRecorder is created. But data is only reported when the PFMR is destroyed.

By that time, UKM may have flushed reports and the entire report of the PFMR is discarded. Maybe it would be better to bind the URL to a UKMSourceID later, during destruction.