I think the grandparent is referencing the fact that Referer headers are not propagated from HTTPS sites to HTTP sites. The rationale was that the HTTPS site m

I think the grandparent is referencing the fact that Referer headers are not propagated from HTTPS sites to HTTP sites. The rationale was that the HTTPS site might have a secret or otherwise sensitive URL. This is obviously a tremendously stupid and ineffective design, which is why it fits so well with the rest of browser security design :)