"Attempt to set a forbidden header was denied: Referer" warning with Firefox

[firewave]

qx.io.remote.Request.send() tries to set the "Referer" header which triggers a warning in the JavaScript console in Firefox.
There was issue #1214 regarding the same message in Safari including some discussion about this behavior.

I am using Firefox 52 64-bit on Windows 10 and qooxdoo 5.0.2.

[level420]

@firewave thank you for reporting this issue. Do you know which firefox version startet to complain about this?

As per https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name it seems that setting the referer programmatically is forbidden.

The code which tries this is here: https://github.com/qooxdoo/qooxdoo/blob/master/framework/source/class/qx/io/remote/transport/XmlHttp.js#L344-L356

[level420]

Here is a fiddle which tries to set the referer in the xhr header: http://jsfiddle.net/patridge/h4Lvp/
It fails on current chrome and firefox and will presumably fail on safari.

It still may succeed on IE 11, but the question is if we still want to have this non-conforming code in.

I'd propose to remove https://github.com/qooxdoo/qooxdoo/blob/master/framework/source/class/qx/io/remote/transport/XmlHttp.js#L344-L356 completely.

[level420]

Created PR #9299