allow referer to come in as a param

HTTP referer gets dropped when coming from HTTPS