Fix Anti-XSS Override

Defining COT_NO_ANTIXSS should disable it completely. The referer check
was still causing the Anti-XSS to trigger