diff --git a/Sources/Actions/Register.php b/Sources/Actions/Register.php
index d6cbf6d375..17a34dfde4 100644
--- a/Sources/Actions/Register.php
+++ b/Sources/Actions/Register.php
@@ -347,9 +347,18 @@ public function show(): void
 	 */
 	public function checkUsername(): void
 	{
-		// Who are you again?
-		if (empty($_COOKIE) || empty($_COOKIE[Config::$cookiename]) || empty($_SERVER['HTTP_REFERER']) || stripos($_SERVER['HTTP_REFERER'], Config::$scripturl) !== 0) {
+		/*
+		 * Who are you again? Somebody with a session, who got here from a page
+		 * of ours. Config::$cookiename is the login cookie, and the person
+		 * filling in the registration form has not got one by definition, so
+		 * asking for it turns everybody this is for away.
+		 */
+		if (empty($_COOKIE) || empty($_SERVER['HTTP_REFERER']) || stripos($_SERVER['HTTP_REFERER'], Config::$scripturl) !== 0) {
+			// And that is the whole answer. Carrying on would send the status
+			// and then the very thing it was refusing.
 			Utils::sendHttpStatus(403);
+
+			Utils::obExit(false);
 		}
 
 		// This is XML!