Firefox 41.0a2
uMatrix 0.9.2.1
Not a clean profile but since I already typed it out I will post this first then confirm it with a clean profile.
Edit:
Confirmed on a clean profile with only xpinstall.signatures.required = false and spoof referer in uMatrix set.

CSP report-uri
google-analytics.com blacklisted through one of the host files.
Clicking a link to https://twitter.com/ will result in a request to https://twitter.com/i/csp_report containing the true referer in the JSON payload.
Setting network.http.referer.XOriginPolicy = 1 blanks the referer as expected, so I expect that it should be doable in uMatrix too.

Origin Header
Go to https://www.youtube.com/ check the request header of the woff2 requests to fonts.gstatic.com. It includes Origin: https://www.youtube.com. No leak in privacy since both domains are owned by Google but I was sure that I saw this somewhere else before.