I\'m experimenting with Firefox\'s Content Security Policy. Basically it\'s a special header for the webpage that tells the browser which resources are valid.
It can be several of other http request types (I am aware of 7 right now, and several place holders for more to come).
I would print the $_REQUEST and $_SERVER to see how it actually arrives.