I had the same problem and resolved it:

I used capitals in the URL that is specified in mainfile.php, so the URL comes closer to the name.

Xoops replaces that character with lowercase characters. It seems to be a security function that XOOPS checks the referrer - with then does not match.

If one of the developers reads this, may I suggest the following solutions:
a) Either just use in the links the URL as it is typed in the mainfile.
b) Or avoid that people configer uppercase characters in their URL
c) Or make the referrer check case ignoring the case.

Thank you

Tonio