security: use no-referrer for outside link to stop leaking potential parameters such

as auth token stored inside GET flags.

- based on hacker-one ticket

rhodecode/templates/base/root.mako

@@ -28,6 +28,13 @@ c.template_context['default_user'] = {
         <link rel="import" href="${h.asset('js/rhodecode-components.html', ver=c.rhodecode_version_hash)}">
         <title>${self.title()}</title>
         <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
+
+        % if 'safari' in request.user_agent.lower():
+            <meta name="referrer" content="origin">
+        % else:
+            <meta name="referrer" content="origin-when-cross-origin">
+        % endif
+
         <%def name="robots()">
             <meta name="robots" content="index, nofollow"/>
         </%def>