Referrers may not be set if the browser does not support it or if the request is not using SSL.
Bots rarely set referrers, also you can validate that the referrer must be set if the page only allows human users as humans use browsers especially on Endpoints that are map methods other than HttpGet
Requirements
Target Platforms: Windows 7, Windows Vista SP1 or later, Windows XP SP3, Windows Server 2008 (Server Core not supported), Windows Server 2008 R2 (Server Core supported with SP1 or later), Windows Server 2003 SP2