Nice! Great thing to build as a Worker, since it can be layered on top of basically any web service without having to change the server code.

Have you had any trouble with some browsers not sending either Origin or Referer, even for legitimate same-origin requests? I seem to remember trying this approach myself several years ago and finding that some users' browsers seemed not to send either header, but I never got a chance to dig into it, and I might be mis-remembering...