I might be mistaken, but the calendar subscription uses the webcal protocol, which the user will not initiate (not rest), but rather Outlook, Apple Calendar, Google Calendar, etc. Consequently, I believe that the originally suggested whitelist could be the correct solution. Or am I mistaken? Is there a possibility for this, even at the code level?