CSP: allow avatars from openvibe.media in img-src (#39)

ddiff --git a/server/app.js b/server/app.js
iindex cbc709e..8edf0fc 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -45,7 +45,7 @@ function createApp(opts = {}) {
          scriptSrc: ["'self'", "'unsafe-inline'", "'wasm-unsafe-eval'", 'https://openvibe.network', 'https://static.cloudflareinsights.com'],
          styleSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://fonts.googleapis.com'],
          fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
--        imgSrc: ["'self'", 'data:', 'https://openvibe.network'],
++        imgSrc: ["'self'", 'data:', 'https://openvibe.network', 'https://openvibe.media'],
          connectSrc: ["'self'", 'https://openvibe.network', 'https://openvibe.download', 'https://openvibe.pics', 'https://cloudflareinsights.com', 'https://openvibe.events'],
          frameSrc: ["'self'"],
          frameAncestors: ["'none'"],
ddiff --git a/test/studio.test.js b/test/studio.test.js
iindex 73f6ab0..a0d7d68 100644
---- a/test/studio.test.js
++++ b/test/studio.test.js
@@@ -243,6 +243,8 @@ test('the app catalogue, the attribution page and the small endpoints answer', a
      { const r = await fetch(s.base + '/release.json'); assert.equal(r.status, 200, 'the navbar release watch polls /release.json'); assert.equal((await r.json()).service, 'studio'); }
      // The release watch then listens on openvibe.events for new releases: the page's CSP must let it (11-09 sweep).
      assert.match((await fetch(s.base + '/')).headers.get('content-security-policy') || '', /connect-src[^;]*https:\/\/openvibe\.events/);
++    // Avatars are served from openvibe.media (the Network's /avatar/<name> redirects there): img-src must let them show.
++    assert.match((await fetch(s.base + '/')).headers.get('content-security-policy') || '', /img-src[^;]*https:\/\/openvibe\.media(?:[ ;]|$)/);
      assert.equal((await fetch(s.base + '/nope')).status, 404);
  });