xblock-external-ui: Alternate referer check for CORS requests