fix fetch-url bug. send Referer header to avoid CSRF warnings.