API: Allowed domains

[jbrooksuk]

For security we could allow the API to only be accessed from certain domains. This could simply be a textarea which you write domains on a new line and restricts requests based on the Origin and Referer headers.

Leaving it empty would open the API to anyone (with authentication).

[ilikeprograms]

Disallowed domains would also be a good idea aswell. So you can block based on the Origin/Referer.

[jbrooksuk]

@ilikeprograms there doesn't seem to be a deny syntax like Access-Control-Allow-Origin, how do you propose blocking?