Feature request: option block requests if "secret" is not present

[Esardes]

thanks for this very useful plugin

1/ would you consider the mentioned request? In your examples you call the header X-From-Cdn, and I would want to block (403?) at plugin level any request that doesn't contain the right value (as a way to guarantee the requests handled only come through Cloudflare/other)

2/ would you consider the plugin to be the best place to optionally "erase" said secret from the request (so that systems behind traefik don't see a difference), or would you rather have us use another middleware to remove it if we want to?