I guess I'd like to know what assumptions about null referers the high traffic sites make. So one is manually typed in URLs. Another is bookmarked URLs. Another is referer disabling in the browser. Does that about cover it?
sure, but bots don't have cookies, and all these have a valid session (using cookies) that have requested at least 2 pages from us. i.e. no bots unless they support cookies.