diff --git a/index.php b/index.php
index e6201839c..adab4118c 100644
--- a/index.php
+++ b/index.php
@@ -133,7 +133,7 @@ if (!empty($RCMAIL->user->ID) && $RCMAIL->task == 'mail') {
 
 // check client X-header to verify request origin
 if ($OUTPUT->ajax_call) {
-  if ($RCMAIL->config->get('devel_mode') && !rc_request_header('X-RoundCube-Referer')) {
+  if (!$RCMAIL->config->get('devel_mode') && !rc_request_header('X-RoundCube-Referer')) {
     header('HTTP/1.1 404 Not Found');
     die("Invalid Request");
   }
diff --git a/program/js/app.js b/program/js/app.js
index 9e10811d5..3812a73de 100644
--- a/program/js/app.js
+++ b/program/js/app.js
@@ -3793,7 +3793,8 @@ function rcube_webmail()
       case 'getunread':
       case 'list':
         if (this.task == 'mail') {
-          this.msglist_select(this.message_list);
+          if (this.message_list)
+            this.msglist_select(this.message_list);
           this.enable_command('show', 'expunge', 'select-all', 'select-none', 'sort', (this.env.messagecount > 0));
           this.enable_command('purge', this.purge_mailbox_test());
         }
@@ -3809,14 +3810,14 @@ function rcube_webmail()
   // handle HTTP request errors
   this.http_error = function(request_obj)
     {
-    //alert('Error sending request: '+request_obj.url);
+    //alert('Error sending request: '+request_obj.url+' => HTTP '+request_obj.xmlhttp.status);
 
     if (request_obj.__lock)
       this.set_busy(false);
 
     request_obj.reset();
     request_obj.__lock = false;
-    this.display_message('Unknown Serer Error!', 'error');
+    this.display_message('Unknown Server Error!', 'error');
     };