I did some checking into this on my install, and the problem was that $adminurl was set to https://localhost/wordpress/wp-admin and $referer was set to https://localhost/wordpress/wp-admin/themes.php so the comparison fails because the referer includes the actual page which refered. This was with Apache 2.0.53, Firefox 1.0.1, and WordPress 1.5.0.
