Fix YouTube embed error 153 by changing Referrer-Policy

[Copilot]

YouTube embeds fail with error 153 because Django 5.x defaults SECURE_REFERRER_POLICY to same-origin, which suppresses the Referer header on cross-origin requests. YouTube's embedded player API requires the Referer header for client identification.

Change:

• Set SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin" in config/settings.py

This is YouTube's recommended policy and the browser default.

Fixes #558

Original prompt

---

This section details on the original issue you should resolve

<issue_title>YouTube embeds fail with a 153 error</issue_title>
<issue_description>Eg on https://simonwillison.net/2024/Jun/21/search-based-rag/

</issue_description>

Comments on the Issue (you are @copilot in this section)

@simonw https://developers.google.com/youtube/terms/required-minimum-functionality#embedded-player-api-client-identity

API Clients that use the YouTube embedded player (including the YouTube IFrame Player API) must provide identification through the HTTP Referer request header. In some environments, the browser will automatically set HTTP Referer, and API Clients need only ensure they are not setting the Referrer-Policy in a way that suppresses the Referer value. YouTube recommends using strict-origin-when-cross-origin Referrer-Policy, which is already the default in many browsers.

I'm sending:

Referrer-Policy: same-origin</body></comment_new>

• Fixes YouTube embeds fail with a 153 error #561

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[simonw]

Looks like this is the correct setting: https://docs.djangoproject.com/en/5.2/ref/settings/#secure-referrer-policy