The app doesn't aggregate content, it displays it. This notion of authorized clients you seem to have doesn't exist. If they put their HTTP port out there, they don't get to say access by Chrome/IE/FF is ok, but curl or your custom app is not. If you then republish the data from your site, that's a wholly separate issue, but displaying it on a viewer directly after requesting it from their site is not aggregation.