fix OSM tiles with lyrk.org

Lyrk.org allows authentication via Referer instead of API keys to avoid others stealing API keys. I recommended them to instead block all requests with obviously wrong Referer (+API key), which still should discourage stealing API keys. Hopefully they’ll implement something like this, at which point the extra rule can be removed.