The http referer is an unstable companion to rely on.
Often it is empty, because it is only filled if you click on a link, not if you type the url directly in the browser/go by bookmark.
In addition, there is an option in most browsers to turn the referral off altogether, as a matter of protecting privacy.
Too many unknown constants, I'm afraid.
I tried to make the referer a part of authentication once. Result?
A lot of complaints 😃
knutm :-)