Lighttpd

OS CentOS 5 i386 running a version of lighttpd above 1.0 (1.4 I think) (it would be nice to easily know how to find the exact version but that's another matter)

Basically in an attempt to slow down hot-linking I have the following sucessful code in lighttpd.conf

$HTTP["referer"] !~ "^(http:\/\/www\<name of site>\.com.*|$)" {
url.rewrite-once = ("/<directory_name>/(.*)$ => /stolen/stolen.flv")
}

which works well at least for IE as Firefox doesn't pass referer as we all know ...

Why then doesn't this work ??

as we are using lighttpd as a streaming media server for flv's our url's are always passing

"GET /<video_media_directory>/<name_of_flv>?start=<startpos>  plus .... a whole  other bunch of data"

There are multiple requests from bogus sites hotlinking these same vids with

"GET /<video_media_directory>/<name_of_flv .." But with NO ?start= data

why then doesn't

$HTTP["querystring"] !~ "(start=.*$)" {
....
}

work in any form of regex till I am black and blue in the face

trying

$HTTP["url"] !~ "(.*start=.*$)" {
..
}

or in any other multiple form refuses to work

How can one use either "url" or "querystring" to block bad requests ??