Use Fetch Metadata

[non-bin]

As another layer of security we can look at the Sec-Fetch-* headers (if they are present) and see if they match our expectations.\n\nhttps://web.dev/fetch-metadata/