Restrict /tile Endpoint to Allowed Hosts Only

[rajadain]

Overview

To discourage tile hotlinking, this adds a check of the HTTP referer field to allow only those in ALLOWED_HOSTS.

This reuses previously created methods for checking the referer field. Leaflet VectorGrid extension doesn't support making requests with custom headers, which is why we're not also reusing the X-OAR-Client-Key check here.

Also adds some tests for these new permissions.

Connects #735

Demo

Testing Instructions

• Check out this branch and visit :6543/
  • Ensure you can still see the tiles

Checklist

• fixup! commits have been squashed
• CI passes after rebase
• CHANGELOG.md updated with summary of features or fixes, following Keep a Changelog guidelines

[jwalgran]

Looking at this now.

[jwalgran]

Confirmed. Nice, clear implementation. I made a suggestion that will allow the unit test to assert 200 instead of 404.

[rajadain]

Thanks for reviewing and for suggesting override_switch. It looks much cleaner with it. Will merge when green.