Fix referer checks with escaped URLs