Assuming referer is required, the following result was found.
Thought I'd put a note about this as I spent ages rewriting an entire system. The HTTP_REFERER environment variable can be changed by the user anyway but I was using it as an additional validation check. The only solution is to not use it for...