I have the client send a custom header with every request, and block all other request.