<% @title = t('.title') %>

<%= form_for(:password_reset,
             :url => user_password_path(@user, :token => @user.confirmation_token),
             :html => { :method => :put }) do |form| %>
  <%= error_messages_for :user %>
  <div class="password_field">
    <%= form.label :password, "Password", :class => 'form__label' %>
    <%= form.password_field :password, :class => 'form__input' %>
  </div>

  <div class="form_bottom">
    <%= form.submit t('.submit'), :data => {:disable_with => t('form_disable_with')}, :class => 'form__submit' %>
  </div>
<% end %>

<% @title = t('.title') %>

<% content_for :head do %>
  <meta name="referrer" content="origin" />
<% end %>

<%= form_for(:password_reset,
             :url => user_password_path(@user, :token => @user.confirmation_token),
             :html => { :method => :put }) do |form| %>
  <%= error_messages_for :user %>
  <div class="password_field">
    <%= form.label :password, "Password", :class => 'form__label' %>
    <%= form.password_field :password, :class => 'form__input' %>
  </div>

  <div class="form_bottom">
    <%= form.submit t('.submit'), :data => {:disable_with => t('form_disable_with')}, :class => 'form__submit' %>
  </div>
<% end %>

Set referrer to origin on password edit page
Set referrer to origin on password edit page

When user request for new password, they receieve following link
http://host/users/:id/password/edit?token=c6f76658472625c9641aaf651a81a71e6b26ab78
which they can use to edit their password.

Clicking on sponsers links at bottom of page was setting `referrer`
header to above mentioned link, leaking password reset token.
