ensure the referer is facebook.com