capabilities might be in a fragment

in which case the Referer header won’t include the bit that is the
capability