Why don't I ask for volunteers to draft a sentence or two on the general issue of security/privacy around 'Referer:' and when it should and shouldn't be sent. If the advice is "Never, unless blah". -- http://www.parc.xerox.com/masinter