Password reset token leaked via HTTP referer

[mlissner]

Somebody reported today that the following steps are bad:

1. Get a forget password link (cl.com/reset-password/some-token-here)
2. Click it
3. Load the page
4. Click the Twitter or Github links at the bottom of the page

If you do that, you'll leak your URL, including the reset token, to those websites. Not great.

This is easy to fix with rel="noreferrer". Unfortunately we can't use referrer-policy because it messes up CSRF protections in Django.

[mlissner]

As part of the upgrade to nginx (#1404), I'm tightening our referrers to be same-origin only. We won't give any referer information to other websites after this goes live. Honestly, referers are a strange information leak and I think it's time we stop sharing this info.