referer protection for photo servlet