Use full URL in wp_get_referer() checks, fixes #19856.