You could still access it if you tried, by forcing the HTTP Referrer header being sent to the server (again via cURL or similar).