@drymer I just pushed a fix to !GNUsocial so POSTs against the API require an HTTP_REFERER value with the same domain as the site is served […]