CSP reports should send an empty 'referrer' rather than nothing.