Who Are You!

This seems like a request header modification question. It says use Pico Browser so I changed user agent then it says I don't trust users visiting from another site.
Im guessing it has something to do with CORS but idk now

Method

It turns out that we need to satisfy multiple requirements in the header in order to get the flag. Please refer to the script.