Checks send no Referer header, so Hetzner answers (closes #191)

The Hetzner speed-test servers close the connection without an answer
when the request has a Referer header. The browser sends one unless the
page comes with the image's Referrer-Policy: no-referrer header, which a
static host and make dev do not send. Each check now sets
referrerPolicy: "no-referrer".

Model: opus-5-5

web/src/main.js

@@ -572,10 +572,11 @@ export class Reporter {
 // it as a timeout. A failed check's reason says what went wrong and after
 // how long; a check that answered has none.
 //
-// The URL is fetched as written, with nothing added to it: the Hetzner
-// speed-test servers close the connection without an answer when the URL
-// has a query string, and cache: "no-store" keeps the browser's cache out
-// of the measurement.
+// The Hetzner speed-test servers close the connection without an answer
+// when the URL has a query string or the request has a Referer header. So
+// the URL is fetched as written, and referrerPolicy: "no-referrer" sends
+// no Referer header, wherever the page is served from. cache: "no-store"
+// keeps the browser's cache out of the measurement.
 export async function measureLatency(url, signal) {
     const controller = new AbortController();
     const timeoutId = setTimeout(
@@ -591,6 +592,7 @@ export async function measureLatency(url, signal) {
             method: "GET",
             mode: "no-cors",
             cache: "no-store",
+            referrerPolicy: "no-referrer",
             signal: controller.signal,
         });
         const latency = Math.round(performance.now() - start);