no-referrer policy: PASS (no Referer header sent)
origin policy: PASS (only origin sent)