Provide mechanism to restrict access to public url (eg from a CDN)

Many customers use a CDN to distribute their web application and do not want traffic to hit their web app, other than from the CDN requesting a refresh. This is a fairly standard pattern but it is not possible to support currently.

This would prevent, for example, a DoS attack.

This needs to be a generic capability and not restricted to select CDNs.