message: Unset CORP header to verify impact on SSTi
diff: @@ -173,7 +173,7 @@ app.use(featurePolicy({
  }
  }))
  app.use(function (req, res, next) {
  - res.setHeader('Cross-Origin-Resource-Policy', 'same-site')
  + // res.setHeader('Cross-Origin-Resource-Policy', 'same-site')
  res.setHeader('Cross-Origin-Opener-Policy', 'same-origin-allow-popups')
  res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
  next() // TODO Replace above manually set headers with helmet solution once supported (see https://github.com/helmetjs/helmet/issues/176)
  