don't use the Referer header, use query param instead