Nimbostratus
Cirrostratus
Does a legitimate client need to authenticate with the application in order to access these URIs? If so, you could look for a successful authentication and use the applications session cookie (or generate your own in the iRule) as a way to restrict access. If the application doesn't require a login, then what's the logic for who you want to allow and who you want to block?
Also, your HTTP_RESPONSE code doesn't look valid. $origin exists isn't a valid iRule command. So I expect that would generate a runtime TCL error. And inserting an HTTP header in a response won't change the client's behavior. ie, it would trigger the client to include that header in a subsequent request. If you want to do something like that you could set a cookie in the response using HTTP::cookie insert.
Aaron