added recommended use of referrer CSP directive