Remove referer header by default.

[sctthrvy]

This seems like the area to remove the most false positives. For example, pretty much all requests are blocked when I go to github.com/scotte/nicstat. This url contains my name so requests coming from the page have "scott" in the referer. We detect this as a leak of PII, thus blocking the innocent requests.

I feel like there are two good options:

1. Remove all referers, then let the request through.
   • Would be a options checkbox.
2. Remove referers which contain PII, then let the request through.
   • Would be displayed clearly in the popup.

I'm leaning towards 2.

[mjsalerno]

I think I agree with 2 as well.