Which can all be faked (eventually), build some kind of validation/authentication system before launching your app. Posted at Nginx Forum: http://forum.nginx.org/read.php?2,257269,257314#msg-257314