I had assumed that Referer URLs were sent even if it wasn't from a link that was clicked. That's not true. (And yes, "Referer" is misspelt in the standard...)
> The Referer field MUST NOT be sent if the Request-URI was obtained from a source that does not have its own URI, such as input from the user keyboard.
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html
> The Referer field MUST NOT be sent if the Request-URI was obtained from a source that does not have its own URI, such as input from the user keyboard.