attempt to bypass cross-site validation by using the referer property