allowedReferer == "*", following .NET logic