make sure HTTP_REFERER exists before trying to use it