This is Django's CSRF module, and it only requires the referer when operating behind HTTPS. The requirement is there to close off edge cases where an attacker

This is Django's CSRF module, and it only requires the referer when operating behind HTTPS. The requirement is there to close off edge cases where an attacker MITMs the initial non-HTTPS request in order to set up compromise of CSRF for future HTTPS requests. HSTS by itself can't solve that. If and when browser support for the Origin header gets more widespread, it'll be possible to secure this without checking Referer. But for now, that's not an option.