prevent third-party requests from using fetch

this patch is pulled out of fetchissues2 branch to separate it from the (much more complex) image version limiting code