cros: Add some docs for how to test a restricted network

Change-Id: I9674404c054854d0653a0f2cd61a3b52a85707a8
Reviewed-on: https://chromium-review.googlesource.com/c/1265077
Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>
Commit-Queue: Jacob Dufault <jdufault@chromium.org>
Cr-Commit-Position: refs/heads/master@{#597167}

docs/login/restrictive_networks.md

@@ -0,0 +1,33 @@
+# Working with Restrictive Networks
+
+ChromeOS login supports letting the user connect to a restricted network,
+such as one that has a captive portal (e.g. a terms of service screen).
+
+Testing on a restricted network can be tricky. The most robust way to test is
+to actually connect your device to a restricted network, but this can greatly
+slow iteration time. An alternative is to run chrome locally with
+`--proxy-server` and run a proxy HTTP server locally that emulates the
+restricted network.
+
+## go-authproxy
+
+[go-authproxy](https://github.com/jacobdufault/go-authproxy) is a proxy that
+implements HTTP basic authentication and supports serving a captive portal.
+
+To require HTTP basic authentication
+
+```sh
+# terminal A
+$ go-authproxy -basic-auth user:pass # interrupt (e.g. <c-c>) to shutdown
+# terminal B
+$ chrome --proxy-server="127.0.0.1:8080"
+```
+
+To show a captive portal
+
+```sh
+# terminal A
+$ go-authproxy -captive-portal # interrupt (e.g. <c-c>) to shutdown
+# terminal B
+$ chrome --proxy-server="127.0.0.1:8080"
+```