Remove hard-coded 'admin' in referer check

Related to issue #2920.