in src/main/java/org/apache/sling/security/impl/ReferrerFilter.java [526:531]
protected boolean isBrowserRequest(final HttpServletRequest request) {
final String userAgent = request.getHeader(USER_AGENT);
return userAgent != null
&& (userAgent.contains(BROWSER_CLASS_MOZILLA) || userAgent.contains(BROWSER_CLASS_OPERA))
&& !isExcludedRegexUserAgent(userAgent);
}