Block access to host api from external sites