That makes sense. Checking the Referer header is a quick and dirty way to implement cross-site request forgery (CSRF) protection.