As an admistrator of the application, I want to restrict access to API by specific referrer

[tloubrieu-jpl]

Motivation

...so that only the web UI can access the API service.

Additional Details

The authorized referrer need to be configurable in the configuration file.

The referrer is added to the API request from the UI, see

Acceptance Criteria

Given a deployment where authorized referrer is XXXX
When I perform a curl request on the api with option --referer XXXX
Then I expect I can access the API

Given a deployment where authorized referrer is XXXX
When I perform a curl request on the api with option --referer YYYY
Then I expect I can not access the API

(TO BE CONFIRMED, I am not absolutly sure how the referrer is set by browser)

Engineering Details