CRM: prevent back office agent from changing event state when viewing its image.

There can be two cases:
- the image is on the same domain that the agent is using, then the agent is logged in
- the image is on another domain, then the agent is not logged in but we can somehow guess from referer that he is viewing the image from ERP5