protected function checkReferer()
    {
        if (!empty($_SERVER['HTTP_REFERER'])) {
            $url = parse_url($_SERVER['HTTP_REFERER']);

            $hostUrl = (array_key_exists('port', $url)) ? $url['host'].':'.$url['port'] : $url['host'];

            if ($hostUrl != $_SERVER['HTTP_HOST']) {
                session_destroy(); // destroy fake session
            }
        }
    }