@dgold http "referer" is a classic header though, I think it makes sense to default to on... this *is* the web after all. It doesn't pass the username it seems but only the instance, which seems sensible for most instances which aren't single user.