* fix docs * Introducing :use * remove note about NoReferrer * xhr requests cannot be used for the json attack, fixes #39