add referrer check to query endpoint to deliver different results to public site vs admin site