The bottom line is, use HTTP_REFERER for "gee, that's nice to know" sorts of information but not for "everything breaks if this is wrong."