How to add in apache referrer policy header

The FOOBAR in %{FOOBAR}e should be an environment variable, but HTTP_HOST is a server variable.

If you really want to do that, you may try:

RewriteRule (.*) $1 [E=custom_host:%{HTTP_HOST}]
RequestHeader set X-Custom-Host-Header "%{custom_host}e"

or

RewriteCond %{HTTP_HOST} (.*)
RewriteRule (.*) $1 [E=custom_host:%1]
RequestHeader set X-Custom-Host-Header "%{custom_host}e"

or

SetEnvIf Host (.*) custom_host=$1
RequestHeader set X-Custom-Host-Header "%{custom_host}e"

All untested.

Not sure of the first one, but the second and third one should work.

This solution does not describe how to strip a header on HTTP only, as asked in the question title.

A safe solution for your problem is to add

proxy_set_header  X-Forwarded-Protocol  $scheme;

It will set X-Forwarded-Protocol to http on HTTP requests and to https on HTTPS requests.

This makes sure that this header is overridden if the client set it, as required by https://docs.djangoproject.com/en/1.4/ref/settings/#secure-proxy-ssl-header.

NOTE: If you are sharing your Django project, please make sure to sufficiently warn users about this if you are including SECURE_PROXY_SSL_HEADER in settings.py, and best comment it out by default.