Adobe Experience Manager Apps provides the ability to update the content of your application over the air (OTA). The updated content is stored on the publish instance. To allow the App on your device to connect to the publish instance and check for updates the publish instance needs to be configured to allow an empty referrer header.
To configure the referrer filter service:
Open the Apache Felix console (Configurations) at:
Login as admin.
In the Configurations menu, select:
Apache Sling Referrer Filter
Check the Allow Empty field, to allow empty/missing referrer headers.
Click Save to save your changes.
See the OSGI Configuration Settings and Security Checklist - Issues with Cross-Site Request Forgery for further details.