Use the presence of cache control header as a hack to detect if the referrer is present (in the case of spoofing or https) (i think...)