Allowed passing referer header in POST requests