Metabox: changed from check admin_referrer to only check nonce field