Blank referrers are allowed

csrf.go

@@ -24,6 +24,11 @@ func strictReferrerCheck(r *http.Request, prefix string, whitelistHeaders []stri
 	}
 
 	referrer := r.Header.Get("Referer")
+
+	if referrer == "" {
+		return true
+	}
+
 	u, _ := url.Parse(referrer)
 	return sameOrigin(u, p)
 }

templates/400.html

@@ -1,5 +1,7 @@
 {% extends "base.html" %}
 
 {% block content %}
+<div id="main">
 	400 Bad Request
+</div>
 {% endblock %}

templates/401.html

@@ -1,5 +1,7 @@
 {% extends "base.html" %}
 
 {% block content %}
+<div id="main">
 	401 Unauthorized
+</div>
 {% endblock %}