Yes, you are right. Whenever user was visiting their page from that specific header,they were not verifying it for the redirection. May be they have some whitelisting of domains.