Some people like to run their browser without sending REFERER headers. I know chrome and firefox can both be configured to do so. That would mean these users would not be able to use your site/app. Better to stick with the tried and true method of a random-ish variable that goes into both the form and the cookie with their values being checked against each other on submission.