Strict Referer domain against XSRF

https://github.com/marienfressinaud/FreshRSS/issues/554