I found the solution myself.
Because window.open calls another domain - window.opener and document.referrer won't work.
The only way here is to use message sending mechanism between windows (web messaging) described here: http://en.wikipedia.org/wiki/Web_Messaging
It looks like all major browsers now support this.
It allows to send message to another windows with different domain and set the expected domain, so in receiving windows you can also set expected domain from where messages can be received - this way you know for sure that this particular domain sent a message and can guarantee the URL of the opener.