My program (Browser) can ask their program (Server) do things. It may deny ANY request it wishes based on ANY criteria that THEY get to set. Their program is under no obligation to do anything my program asks.
Their program (Server) may ask my program (Browser) to do things and my program may deny ANY request based on ANY criteria that I get to set. My program is under no obligation to do anything their program asks.
This is all perfectly reasonable and fair.