Google's new privacy standard scrambles the one field of a web request that still travels in the clear: the name of the site being opened.