True, but the OP didn't specify any concerns about malicious users trying to break the app. The referer business is unreliable even when users are friendly.

UPDATE: I guess "spoofed" does sound like a concern about tampering by users.