fix(handler): preserve origin on form submissions

Use the same-origin referrer policy to prevent Chrome from sending a null Origin header on POST requests.

app/internal/handler/handler_test.go

@@ -56,6 +56,9 @@ func TestListRendersEscapedTodos(t *testing.T) {
 	if strings.Contains(recorder.Body.String(), "<script>") || !strings.Contains(recorder.Body.String(), "&lt;script&gt;") {
 		t.Fatalf("title was not escaped: %s", recorder.Body.String())
 	}
+	if got := recorder.Header().Get("Referrer-Policy"); got != "same-origin" {
+		t.Fatalf("Referrer-Policy = %q, want %q", got, "same-origin")
+	}
 }
 
 func TestCreateValidatesAndTrimsTitle(t *testing.T) {