remove note about NoReferrer
rework protection headers, fixes #40
xhr requests cannot be used for the json attack, fixes #39