If the origin and referer header check per the OWASP CSRF cheat sheet is followed, will valid requests be blocked (ignoring the token part of the recommendation for this question)? I've seen some references to the fact that such headers are not always sent so if requests are blocked if neither is present, then perhaps valid requests are being blocked. Is this considered a real issue?
Additional edit: The requests I am trying to check are only those that change the state (database) of the site. I would not allow $_GET requests to change the state. I would not apply the header check against $_GET requests that do not change the site.