The view beacon's answer may be read by openvibe.video (helmet's same-origin resource policy refused it) (#326)

ddiff --git a/server/media-proxy/view-beacon.js b/server/media-proxy/view-beacon.js
iindex 8eaaca84..c539ee75 100644
---- a/server/media-proxy/view-beacon.js
++++ b/server/media-proxy/view-beacon.js
@@@ -59,6 +59,9 @@ function createViewBeacon({ rateLimit }) {
          const origin = req.get('origin');
          if (!origin || !VIEW_ORIGINS.has(origin)) return res.status(403).json({ error: 'Origin not allowed' });
          res.set('Access-Control-Allow-Origin', origin);
++        // Helmet's same-origin resource policy made the browser refuse the beacon's answer (a console error on every
++        // watch page; the view was still counted): the allowed site may read it.
++        res.set('Cross-Origin-Resource-Policy', 'cross-origin');
          res.set('Vary', 'Origin');
          res.set('Cache-Control', 'no-store');
          if (req.method === 'OPTIONS') {
ddiff --git a/test/view-beacon.test.js b/test/view-beacon.test.js
iindex 688535c6..5e3a1a6f 100644
---- a/test/view-beacon.test.js
++++ b/test/view-beacon.test.js
@@@ -57,6 +57,7 @@ const rateLimit = require('express-rate-limit');
          let r = await post('/api/views/vod/1');
          assert.strictEqual(r.status, 204);
          assert.strictEqual(r.headers.get('access-control-allow-origin'), 'https://openvibe.video');
++        assert.strictEqual(r.headers.get('cross-origin-resource-policy'), 'cross-origin', 'the watch page may read the answer');
          assert.deepStrictEqual(rows, ['vod|1|203.0.113.5'], 'a public VOD is counted for the viewer\'s address');
  
          r = await post('/api/views/vod/1');