in reply to Referer header

CSRF is often implemented with cookies:

https://metacpan.org/pod/LWP::UserAgent#cookie_jar