CSP 1.1: Fail closed for the 'referrer' directive.