The check used to be necessary because we validated the referrer too and this bypass was a workaround a bug that is present in some browsers that do not send the correct referrer.
spec/*