You control the Referer header (curl -H "Referer: <img src=x onerror=alert(document.domain)>"). Most hunters never touch it.
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only