Use both noopener and noreferrer

bookwyrm/templates/settings/federation/instance_blocklist.html

@@ -47,7 +47,7 @@
     <div class="field">
         <label class="label" for="id_file">JSON data:</label>
         <aside class="help">
-            Expects a json file in the format provided by <a href="https://fediblock.org/" target="_blank" rel="noopener">FediBlock</a>, with a list of entries that have <code>instance</code> and <code>url</code> fields. For example:
+            Expects a json file in the format provided by <a href="https://fediblock.org/" target="_blank" rel="noopener noreferrer">FediBlock</a>, with a list of entries that have <code>instance</code> and <code>url</code> fields. For example:
             <pre>
 [
     {

bookwyrm/templates/settings/link_domains/link_domains.html

@@ -36,7 +36,7 @@
             <header class="column">
                 <h2 class="title is-5">
                     {{ domain.name }}
-                    (<a href="http://{{ domain.domain }}" target="_blank" rel="noopener">{{ domain.domain }}</a>)
+                    (<a href="http://{{ domain.domain }}" target="_blank" rel="noopener noreferrer">{{ domain.domain }}</a>)
                 </h2>
             </header>
             <div class="column is-narrow">

bookwyrm/templates/settings/link_domains/link_table.html

@@ -12,7 +12,7 @@
     {% for link in links %}
     <tr>
         <td class="overflow-wrap-anywhere">
-            <a href="{{ link.url }}" target="_blank" rel="noopener">{{ link.url }}</a>
+            <a href="{{ link.url }}" target="_blank" rel="noopener noreferrer">{{ link.url }}</a>
         </td>
         <td>
             <a href="{% url 'settings-user' link.added_by.id %}">@{{ link.added_by|username }}</a>