you could check the HTTP referer field

But be careful. The HTTP spec makes the referer header optional, and (in violation of the spec) a number of proxy servers munge the referer to either a URL advertising the proxy, or to a string of Xs. You could lock users out by accident.