Disable Referrer-Policy by default for now

Author: Tom Gilligan

lib/secure_headers/configuration.rb

@@ -117,6 +117,7 @@ def deep_copy_if_hash(value)
 
     def initialize(&block)
       self.hpkp = OPT_OUT
+      self.referrer_policy = OPT_OUT
       self.csp = self.class.send(:deep_copy, CSP::DEFAULT_CONFIG)
       instance_eval &block if block_given?
     end

spec/spec_helper.rb

@@ -30,7 +30,7 @@ def expect_default_values(hash)
   expect(hash[SecureHeaders::XXssProtection::HEADER_NAME]).to eq(SecureHeaders::XXssProtection::DEFAULT_VALUE)
   expect(hash[SecureHeaders::XContentTypeOptions::HEADER_NAME]).to eq(SecureHeaders::XContentTypeOptions::DEFAULT_VALUE)
   expect(hash[SecureHeaders::XPermittedCrossDomainPolicies::HEADER_NAME]).to eq(SecureHeaders::XPermittedCrossDomainPolicies::DEFAULT_VALUE)
-  expect(hash[SecureHeaders::ReferrerPolicy::HEADER_NAME]).to eq(SecureHeaders::ReferrerPolicy::DEFAULT_VALUE)
+  expect(hash[SecureHeaders::ReferrerPolicy::HEADER_NAME]).to be_nil
 end
 
 module SecureHeaders