pass referer to external system

We need to pass the referer to the external system. `request.referer` gets lost through HTTPS so don't rely on it.