Don't attempt to set Referrer policy in Safari
While Safari supports the policy, it does not (currently, as of 9.x)
recognize `origin-when-cross-origin` as a valid value, so we omit the
policy entirely under Safari.
Closes#5609
See merge request !2269