Limit QR to referrer of its own hostname