Have you tried using something that would capture the header information? E.g., $http_referer and such? The rules themselves aren't extremely tough, so you've probably solved this by now (: