Add referer checking

I hope this doesn't just give a false sense of security. This doesn't
effectively prevent CSRF, but it should prevent you from using up API requests
or logging users our by just hot-linking resources.