Using referer header for enhanced security

Many uses of Supabase are from a specific website.

Currently it looks like one can use PostgREST http settings in database calls like (current_setting('request.headers', true)::json->>'referer')::text to enforce access only from certain websites.

My quick tests show this comes thru to RLS and rpc functions. The referer header by my understanding can not be changed by javascript code so should be secure. I've used it in a PHP API a while back to limit access.

So...
First is this a valid way to further limit access to the database for anon access?
And second (for the team) how hard is this to add to gotrue and storage as a setting for trigger functions and RLS to examine?

In the end, the ability to set an overall list of referers that can access the entire infrastructure seems to be ideal.

Am I missing something?