net/http: be more careful about when we send Referer headers

[bradfitz]

We shouldn't:

1) send https referers to non-http sites on redirects (IIRC)
2) send username:password@ URL components in redirects

Part 2) and part of part 1) was implemented in https://golang.org/cl/9766046/
but never submitted.

[rsc]

Comment 1:

Sounds important for 1.4.

[frederich]

Comment 2:

I'll polish it up.

[gopherbot]

Comment 3:

CL https://golang.org/cl/151430043 mentions this issue.

[bradfitz]

Comment 4:

This issue was closed by revision f739b77.

Status changed to Fixed.