fixes nopriv and check referer