Comment 23 for bug 560246

It's not the users task to decide nor recognize if login.launchpad.net is part of launchpad software or not - the domain tells enough.

If, as you say, referer checks used only for POST request wouldn't do any harm, then these comments prove the opposite.