The new feature issue has been fixed and turned out to be a problem that's been in the system for almost a year. However, it is a very rare scenario and has never been reported by users.
GEEK-SPEAK
In any case, the scenario is now accounted for on all requests and won't be an issue from now on. This may have affected some requests, only when using javascript/AJAX/etc WITH lock to account enabled AND the referrer was setup properly, that the script may not have properly reported the primary referrer. In that case, we had to substitute an alternate referrer, which we already made available, but I did not realize was required in some cases.

