Allow Network session checks on Studio (#40)

ddiff --git a/server/app.js b/server/app.js
iindex 8edf0fc..929043a 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -47,7 +47,7 @@ function createApp(opts = {}) {
          fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
          imgSrc: ["'self'", 'data:', 'https://openvibe.network', 'https://openvibe.media'],
          connectSrc: ["'self'", 'https://openvibe.network', 'https://openvibe.download', 'https://openvibe.pics', 'https://cloudflareinsights.com', 'https://openvibe.events'],
--        frameSrc: ["'self'"],
++        frameSrc: ["'self'", 'https://openvibe.network'],
          frameAncestors: ["'none'"],
          objectSrc: ["'none'"],
          workerSrc: ["'self'", 'blob:'],
ddiff --git a/test/studio.test.js b/test/studio.test.js
iindex a0d7d68..e6792e7 100644
---- a/test/studio.test.js
++++ b/test/studio.test.js
@@@ -245,6 +245,7 @@ test('the app catalogue, the attribution page and the small endpoints answer', a
      assert.match((await fetch(s.base + '/')).headers.get('content-security-policy') || '', /connect-src[^;]*https:\/\/openvibe\.events/);
      // Avatars are served from openvibe.media (the Network's /avatar/<name> redirects there): img-src must let them show.
      assert.match((await fetch(s.base + '/')).headers.get('content-security-policy') || '', /img-src[^;]*https:\/\/openvibe\.media(?:[ ;]|$)/);
++    assert.match((await fetch(s.base + '/')).headers.get('content-security-policy') || '', /frame-src 'self' https:\/\/openvibe\.network(?:;|$)/);
      assert.equal((await fetch(s.base + '/nope')).status, 404);
  });