Require a directory prefix for camera URL pins

The URL parser already turns backslashes into separators, so only encoded
separators need refusing; a pin prefix without a trailing slash is treated as
a directory.

server/providers/cctv/normalize.js

@@ -664,8 +664,8 @@ export function isLikelyTorontoCoordinate(lat, lon) {
  * A camera URL under a pinned directory, by parsed URL rather than string
  * prefix: the same scheme and exact host as `prefix`, no credentials, the
  * default port, and a normalized path inside the prefix's directory. Dot
- * segments (including encoded ones) are resolved before the path is compared,
- * and an encoded slash or backslash is refused.
+ * segments (including encoded ones) and backslashes are resolved before the
+ * path is compared, and an encoded slash or backslash is refused.
  *
  * @param {string} raw - Camera URL from a catalog or redirect.
  * @param {string} prefix - Pinned origin and directory, ending in `/`.
@@ -686,8 +686,10 @@ export function pinnedCameraUrl(raw, prefix) {
     url.username ||
     url.password ||
     url.port ||
-    !url.pathname.startsWith(pin.pathname) ||
-    /%2f|%5c|\\/i.test(url.pathname)
+    !url.pathname.startsWith(
+      pin.pathname.endsWith('/') ? pin.pathname : `${pin.pathname}/`,
+    ) ||
+    /%2f|%5c/i.test(url.pathname)
   )
     return null;
   return url.href;