Why anyone would base their security solely on the easily spoofable http_referer is beyond me. Actually I guess its because its easy to implement.... but still, its worthless when it comes to people/software like pornasaur etc.. and now google :P Crazy.
If your doing this and need some ideas (and have a little money to spend for a solution) ICQ me sometime and we can probably come up with something for you.