I'm not sure I follow the problem here.
http:// is according to this required to be removed from the querystring. Whenever it is present it *should* throw a 403.
Looks to me that the .htaccess hasn't been modified or is cached server side (which it shouldn't be).
header('HTTP/1.1 420 Enhance Your Calm');