As I understand matters, what the "hitting Enter on the address bar" step does is re-send the request without the "referer" header which
tags it as originating from a different Website.
Some sites will return 403 errors unless the request has a "known correct" referer header, i.e. one tagging the request as originating from a
known-legitimate site. Others, like this one, just do it for requests which have a "not known correct" header, and allow non-referred requests
through. In both cases the goal is to prevent leeching; one is just more stringent than the other.
tags it as originating from a different Website.
Some sites will return 403 errors unless the request has a "known correct" referer header, i.e. one tagging the request as originating from a
known-legitimate site. Others, like this one, just do it for requests which have a "not known correct" header, and allow non-referred requests
through. In both cases the goal is to prevent leeching; one is just more stringent than the other.