Set referrer policy to avoid leaking URL auth params

We're only leaking these to ourselves (strict-origin-when-cross-origin
is the default, which is equivalent to this for connections elsewhere)
and the auth token is only useful if you can access the local-only
CORS-blocked local admin port, but it's still a good idea not to let it
leave the machine.

Author: pimterry

Caddyfile

@@ -16,5 +16,7 @@
     header @get Cache-Control "public, max-age=60, stale-while-revalidate=600, stale-if-error=86400"
 
     header Content-Security-Policy "frame-ancestors 'none'"
+    header Referrer-Policy "strict-origin"
+
     header X-Clacks-Overhead "GNU Terry Pratchett" # https://xclacksoverhead.org
 }