remove CORS settings on /editor: this was needed when we were externally embedding horizon/CPO for the web extension, but we can do that statically now. This messes with the picker and Google APIs

Author: jpolitz

src/server.js

@@ -529,8 +529,6 @@ function start(config, onServerReady) {
   });
 
   app.get("/editor", function(req, res) {
-    res.set("Cross-Origin-Resource-Policy", "cross-origin");
-    res.set("Cross-Origin-Embedder-Policy", "require-corp");
     res.render("editor.html", {
       PYRET: process.env.PYRET,
       BASE_URL: config.baseUrl,