connect-src: allow https://openvibe.chat for the navbar's Messages count (openvibe-shared 4.130.0) (#326)

ddiff --git a/server/app.js b/server/app.js
iindex 041f867..78f790f 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -137,7 +137,7 @@ function createApp(opts = {}) {
          res.setHeader('X-Content-Type-Options', 'nosniff');
          res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
          // Cloudflare's edge adds its Web Analytics beacon to HTML pages: its script and its report are the only outside sources.
--        res.setHeader('Content-Security-Policy', ["default-src 'self'", "script-src 'self' https://static.cloudflareinsights.com", "connect-src 'self' https://cloudflareinsights.com",
++        res.setHeader('Content-Security-Policy', ["default-src 'self'", "script-src 'self' https://static.cloudflareinsights.com", "connect-src 'self' https://openvibe.chat https://cloudflareinsights.com",
              "frame-ancestors 'self'", "object-src 'none'", "base-uri 'self'"].join('; '));
          next();
      });
ddiff --git a/test/home.test.js b/test/home.test.js
iindex 325e17b..7c384d5 100644
---- a/test/home.test.js
++++ b/test/home.test.js
@@@ -99,7 +99,7 @@ const { boot, check, done } = require('./helpers/app');
  
      await check('the rest of the site keeps its own CSP', async () => {
          const r = await get('/pair/rob_nothing', alex);
--        assert.strictEqual(r.headers.get('content-security-policy'), "default-src 'self'; script-src 'self' https://static.cloudflareinsights.com; connect-src 'self' https://cloudflareinsights.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'");
++        assert.strictEqual(r.headers.get('content-security-policy'), "default-src 'self'; script-src 'self' https://static.cloudflareinsights.com; connect-src 'self' https://openvibe.chat https://cloudflareinsights.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'");
      });
  
      await check('a browser that asks for a missing page gets the site 404 page in the Frame', async () => {