This error, especially when occouring with one (or a small handful) of user(s) happens when they're using a security suite (generally norton or symantec) which blocks the Referrer Variable for "security". They should add your site(s) to their allowed list or disable the option altogether within their application.
