Function from_host 

pub(crate) async fn from_host(state: &AppState, headers: &HeaderMap) -> bool

Is this request from the CEF host? X-Host-Token must be the IPC token the host registered with (host_ipc.Register), which agents never see; the instance auth key alone, which every agent has, isn’t enough.