fix issue which broke working w/ token services

This also fixes important issue when using allowedReferers.