Add new decorator to prevent reflected text attacks

Instead of disabling repo names with periods in them, we simply disallow calls to the API when they are GET requests, whose path ends in a dot, and that do not have a referrer from the frontend.

util/config/schema.py

@@ -591,6 +591,11 @@ CONFIG_SCHEMA = {
                      'not authenticated as a superuser',
       'x-example': 'somesecrethere',
     },
+    'BROWSER_API_CALLS_XHR_ONLY': {
+      'type': 'boolean',
+      'description': 'If enabled, only API calls marked as being made by an XHR will be allowed from browsers. Defaults to True.',
+      'x-example': False,
+    },
 
     # Time machine and tag expiration settings.
     'FEATURE_CHANGE_TAG_EXPIRATION': {