Comment 55 for bug 560246

I didn't bother reading the entire thread, but relying on Referer header instead of proper cookies usage or server-side session management bothers me.

Change this requirement please. There are better ways. Drop the referrer need.