Verifying the origin of the request received by a resource server - comments