implemented CORS and referer validation