How to make sure requests are from my website?
<p>Some smartass people are using my api-centric web app to clone my service and make it appear like their own. Is there a way to make sure all ajax requests are for/from my website?</p>

<p>Sure I could use the referrer header but they could easily fake it.</p>
