HTTP_REFERER replaced with SESSION[current_url] since HTTP_REFERER is not reliable