Trusted in this case means, it was Icinga Web that
rendered a link and the user followed it. Whether
a source is trustworthy or not is detected by use
of the user's session id to hash it combined with
the source similar to how CSRF tokens are assembled.
(cherry picked from commit ec40efe1578c3c9cb445638f78e76a940a6864cf)