I assume `req` will always have a `Referer` method, even if the user agent doesn't send a header?