Add the line
user_pref(“capability.policy.default.Window.onunload”, “noAccess”);
to your user.js file.
this:
user_pref(“network.http.sendRefererHeader”, 0);
also seems to be a valid workaround, though the first is preferred by content providers who track these things.