External links set as noreferrer

* Security by default (per browser support)

Prevent leaking HTTP site locations via referrer. *Or spamming them with developer hostnames. Depends on your POW.*

Maybe consider using http://no-ref.appspot.com/ or some anonymizer for HTTP sites?
*I did some research and have not found anonymizer backed by trustworthy and independent party (more than just one user, company or organization with no history and provable focus on privacy). Maybe you will have more luck or create one.*