now requiring either a source parameter, or an HTTP Referer