There are some misguided firewalls (*cough*norton*cough*) which eat the referer in the name of privacy. You could try allowing requests with no referer as well as requests with the correct referer, as people who follow links from off-site will usually send referer headers.