The initial checks on both methods should be reconciled.

  if (!device_->IsAccessAllowed(this) || !InFocusedFrame()) {

 

We currently check for a secure origin in VRDisplayHost::RequestPresent() and are adding another check in RequestSession(). Instead, we should check for secure origin before even providing an instance of the VRDisplayHost interface to the renderer process. That way, we don't need to include this check in multiple methods.