It's possible that they set the header at their gateway so that it will override whatever you set from your device. It's also possible that the app is firewalle

It's possible that they set the header at their gateway so that it will override whatever you set from your device. It's also possible that the app is firewalled to only be accessible directly from their mobile network. Of course, it's also possible that at least one operator isn't following appropriate measures to make this secure.