This is actually up to the client. In Firefox about:config, network.http.sendSecureXSiteReferrer is set to true by default, so it does send it, but you can turn it off.