add refererPath field to WebSession::Context

A few things in WordPress don't work properly if the `Referer` header is not set. This patch forwards the header and adds some cross-site request forgery protection.