title: Referrer header not included in stylesheet request inside iframe
body: <p>I'm trying to load in an external font (using the font provider's hosted CSS) from inside a sandboxed iframe. The font provider seems to be authorizing whether the font can load or not based on the contents of the <code>Referrer</code> header. However, when the request is made from inside the iframe, that header is not present (according to Chrome's devtools). Setting <code>referrerpolicy="origin"</code> on the <code>&lt;iframe&gt;</code> element doesn't seem to change anything. Tested in Chrome and Firefox.</p>
  
  <p>Do I need to add a special attribute to my <code>&lt;link&gt;</code> tag, too? Is there something else I'm missing?</p>