Maison Retail tightens who gets to knock on its backend

Web apps run on a kind of guest list: the browser only lets the approved front-end website exchange data with the back-end server. This fork rewrote that check to be both stricter and smarter. The old setup matched the approved address against incoming requests exactly, so an address written with a trailing slash - a near-invisible difference - could silently block the real front end and break the app for no obvious reason.

The new version cleans up both sides before comparing them, prints the approved address at startup so deployment problems are easier to trace, and clearly turns away anything that doesn't match. It's small, self-contained, and not tied to this fork's particular setup.