Fixed #20411 -- Don't let invalid referers blow up CSRF same origin checks.

Thanks to edevil for the report and saz for the patch.