Rest csrf local referer