further more: this is one and the only proper protection. Referer: not reliable, proxies omit it Origin: not supported yet Additional header: could be tricked

further more: this is one and the only proper protection. Referer: not reliable, proxies omit it Origin: not supported yet Additional header: could be tricked with Flash vuln