This might be their “context aware” security feature. Which can prevent access to certain things based on device, browser, etc.

I don’t see why any of that can’t rely on a chrome extension implementation using the privileged APIs to verify OS, Browser, etc. Struggling to understand why they need special headers for any of this functionality.