You could also add an optional GET param that allows the user to override the url for which a QR code is generated (so ?url=... would override the default functionality of detecting the url)
That parameter would also be useful and needed for https urls - browsers aren't supposed to pass those along as referrers.
This is true unless the image is served from https aswell. In that case referer is sent just as normal. I'm getting a certificate this week to serve https QRs!