Referer

Add allowed referers to bypass regular auth
there's probably an easier way to check the referrer without having to explicitly set the ALLOWED_REFERRERS.
what we know is that the edcast widget is deployed on www.edcast.com, and the CAMO server is deployed on images.edcast.com. So we can simply extract the top level domain(edcast.com) out of from the referrer and the Host header to see if they match.