Clarify when Referer is sent

[mnot@…]

Current browser implementations often omit the Referer header, even when there is a URI available. From the source e-mail;

1. The attacker hosts his HTML page over HTTPS and mounts a CSRF

attack against an HTTP URL.

2. The attacker hosts his HTML page over FTP. Browsers don't send FTP

URLs in the Referer header.

3. The attacker hosts his HTML page over GOPHER. Browsers don't send

GOPHER URLs in the Referer header

4. The attacker hosts his HTML in a DATA URL. Browser don't send DATA

URLs in the Referer header.

5. The attacker hosts his HTML in a frame whose URL is the empty string.

Referer's definition should be clarified to state that it (SHOULD|MUST) be sent for non-HTTP URIs. Additionally, it may be worth considering specifying a special value (e.g., "null") to be sent when there is no referer.

[julian.reschke@…]

proposed change for part 2.

[julian.reschke@…]

From [593]:

Allow Referer value of "about:blank" as alternative to not specifying it (related to #144)