Update documentation
 * add paragraph about HTTP Referer header (work on #396)
 * split "What RequestPolicy cannot help with"