Fixing JSON CSRF problem with Referer