add fromAllowedReferre flag to whitelisted requests