We have a bit of the site that wants to act on the "referer" header sent by a user's browser. Best we can tell, this is being filtered out by railway for some reason.