CSP 1.1: Drop 'always' from referrer values.
CSP 1.1: Change 'none-when-insecure' to 'none-when-downgrade'.