Spoofing the referrer header is trivial and so wouldn't offer any protection in this case. I do, however, wonder if there would be any benefit to scraping the

Spoofing the referrer header is trivial and so wouldn't offer any protection in this case. I do, however, wonder if there would be any benefit to scraping the beewulf site. Retrieving and parsing the relevant headers yourself is trivial and would remove from your hypothetical clone app any dependency on beewulf.