title: XHR2 allow origin - can this be faked?
body: <p>With regards to the way resources accessed over XHR2/CORS can block the request unless it came from a whitelisted domain:</p>
  
  <ul>
  <li>which header is read to determine the referrer domain - is it the standard HTTP_REFERRER?</li>
  <li>could someone send a request pretending to be from another domain somehow?</li>
  </ul>
  
  <p>I'm aware CORS is not a reliable means of securing data - I ask only as a point of curiosity.</p>