Fix WAF 403 by sending same-origin Origin/Referer to Source API

api_headers() hardcoded Origin/Referer to tconnect.tandemdiabetes.com,
but requests target SOURCE_URL (source.tandemdiabetes.com /
source.eu.tandemdiabetes.com). The WAF enforces same-origin and
returned HTTP 403 ("The request is blocked"). Derive Origin/Referer
from SOURCE_URL so both US and EU regions match.

tconnectsync/api/tandemsource.py

@@ -365,8 +365,11 @@ class TandemSourceApi:
             raise Exception('No access token provided')
         return {
             'Authorization': 'Bearer %s' % self.accessToken,
-            'Origin': 'https://tconnect.tandemdiabetes.com',
-            'Referer': 'https://tconnect.tandemdiabetes.com/',
+            # The WAF enforces same-origin: Origin/Referer must match SOURCE_URL
+            # (source.tandemdiabetes.com / source.eu.tandemdiabetes.com), otherwise
+            # it returns HTTP 403 ("The request is blocked").
+            'Origin': self.SOURCE_URL.rstrip('/'),
+            'Referer': self.SOURCE_URL,
             **base_headers()
         }