rebased CORS_REPLACE_HTTPS_REFERER pull request