referer checking not always works, some proxies or even browsers strip HTTP_REFERER header from http requests.
it's much better to check some cookies in your content-generating code [ eg index.php that generates picture gallery ] and check on mod-rewrite or apache2 level if cookie is set to expected value.