Allow Network session checks on Chat and Party (#505)

ddiff --git a/server/web/layout.js b/server/web/layout.js
iindex 71fdbcd..392d8a1 100644
---- a/server/web/layout.js
++++ b/server/web/layout.js
@@@ -98,7 +98,7 @@ function contentSecurityPolicy(nonce, wsOrigin = 'wss://openvibe.chat', partyPro
          // GETs and only with the person's own Bearer (the Actor API's CORS route).
          `connect-src 'self' ${wsOrigin} https://openvibe.chat https://openvibe.actor https://openvibe.network wss://openvibe.network https://openvibe.events wss://openvibe.events https://cloudflareinsights.com`,
          // A workspace room's shared screen: a screen share page from OpenVibe.Bot (rooms.screen_url).
--        `frame-src 'self' https://openvibe.bot https://*.openvibe.link${partyProviders ? ' https://www.youtube-nocookie.com https://player.twitch.tv https://embed.twitch.tv' : ''}`,
++        `frame-src 'self' https://openvibe.bot https://*.openvibe.link https://openvibe.network${partyProviders ? ' https://www.youtube-nocookie.com https://player.twitch.tv https://embed.twitch.tv' : ''}`,
          "frame-ancestors 'self'",
          "base-uri 'self'",
          "object-src 'none'",
ddiff --git a/test/workspace.test.js b/test/workspace.test.js
iindex 62e6a88..2fdff27 100644
---- a/test/workspace.test.js
++++ b/test/workspace.test.js
@@@ -215,6 +215,7 @@ t('a workspace room shows its shared screen to members only; only a Bot screen l
      const page = await h.http('GET', '/r/staff', { headers: { cookie: `ov_token=${staff.token}` } });
      assert.match(page.text, new RegExp(`<iframe src="${link.replace(/\//g, '\\/')}"`));
      assert.match(page.headers.get('content-security-policy'), /frame-src 'self' https:\/\/openvibe\.bot/);
++    assert.match(page.headers.get('content-security-policy'), /frame-src[^;]* https:\/\/openvibe\.network(?:;|$)/, 'Network silent session check is allowed');
      assert.strictEqual((await api('GET', '/rooms/staff', user)).status, 404, 'others never see the link');
      assert.strictEqual((await api('PATCH', '/rooms/staff', staff, { screen_url: '' })).status, 200);
      assert.ok(!(await api('GET', '/rooms/staff', staff)).body.screen, 'cleared');