What is the cost of failure in your scenario? Are people going to be able to make serious money off of cheating you, or are you going to get a few misimpressio

What is the cost of failure in your scenario? Are people going to be able to make serious money off of cheating you, or are you going to get a few misimpressions from buggy browsers? If the cost and risk are low, then HTTP_REFERER is good enough. If not, then you are going to get very friendly w/ javascript and authentication of untrusted requests.