check where the request is from

Attempt at plugging security hole