Function from_a_page 

pub fn from_a_page(site: Option<&str>) -> bool

Check the two things that must hold before any control route runs, returning the refusal if there is one.

Separated from routing so that a caller cannot reach a route without going through it: there is no path to the annotation handlers that does not pass this function first. Whether a request could have come from a page.

Measured rather than assumed. In Chromium an extension’s fetch arrives with Sec-Fetch-Site: none and no Origin at all, while a page the daemon itself serves in the no-proxy fallback mode – which is same-origin with the control API, and so the hardest case – arrives with same-origin. Anything from another site is cross-site.

Absent means no browser sent it. That is a local process, which could read the token file directly, so refusing it here would protect nothing.