1. A method of verifying if a request for a second digital document originates from a reference within an authentic copy of a first digital document, the method comprising: sending, by a first computer, the first digital document to a second computer via a computer network; receiving, by the second computer, a possibly tampered version of the first digital document via the computer network; calculating, by the first computer, a first authentication tag on at least a part of the first digital document; calculating, by the second computer, a second authentication tag on at least a part of the possibly tampered version of the first digital document; sending, by the second computer, the request for the second digital document referenced in the possibly tampered version of the first digital document to the first computer via the computer network, the request including the second authentication tag; receiving, by the first computer, a possibly tampered version of the request and deducts the second authentication tag; determining, by the first computer, the possibly tampered version of the request as originating from an authentic copy of the first digital document if the second authentication tag is equal to the first authentication tag; sending, by the first computer, the second document to the second computer only if the second authentication tag is equal to the first authentication tag; monitoring, by a computer program running on the second computer, data recorded to detect unusual behavior including at least one of, timing of input data received from the user, value of input data received from the user, and visibility of data to be presented to the user; sending, by the second computer, a report to the first computer on detected behavior on the second computer; and storing, by the second computer, a copy of at least a part of the last accepted state of user data typed into the possibly tampered version of the first digital document, wherein, if unusual behavior is detected while the user data in the possibly tampered version of the first digital document is edited, at least a part of the user data in the possibly tampered version of the first digital document is rolled back to the last accepted state by overwriting the at least the part of the user data in the possibly tampered version of the first digital document with the stored copy of the at least the part of the last accented state, the computer program is configured to calculate the second authentication tag, at least one of the first authentication tag and the second authentication tag is calculated more than once by the second computer, at least one of the first authentication tag and the second authentication tag is calculated on at least one of the following events, the document is loaded the document is shown, a link in the document is activated, script code in the document is activated or executed, an amount of time has elapsed, a change has occurred to the possibly tampered version of the first digital document, and a change has occurred to user data entered into the possibly tampered version, and at least one of the first and second authentication tags is calculated by at least one of, a hash function, a message authentication code function, and an asymmetric digital signature algorithm.
7. The method according to claim 1 , wherein the second computer is a web browser.