Handling cross-site data requests, proxy should check refering URL