fix for #5, don't block other referers using the JSONP API