Allow customization of Referrer-Policy

I don’t see much value in the downgrade case. The default is safe as-is.