Hello Johan,
However our HTTP request still appears with the header Referer in it.
What do you mean by that?
The browser would still send this header.
What will happen is that the Web Dispatcher will remove it before sending it to the backend system.
Regards,
Isaías