Use additional “password” in Referer to hide private site?

security.stackexchange.com