we now check the referer to prevent CSRF attacks