separate is_same_domain_referer function
forbid cross-domain request on api methods
decument CROSS_DOMAIN_REQUEST api error