Fetch API should strip fragment and credentials from URLs used as referrer. Or it should be done by underlying loader code.
Created attachment 285414 [details] Patch
Comment on attachment 285414 [details] Patch Clearing flags on attachment: 285414 Committed r204224: <http://trac.webkit.org/changeset/204224>
All reviewed patches have been landed. Closing bug.
Looks like 2 tests are failing on the bots after this change: https://build.webkit.org/results/Apple%20El%20Capitan%20Release%20WK2%20(Tests)/r204224%20(8292)/results.html Please fix ASAP.
Will do in an hour