Hmm, maybe you could use Content-Security-Policy to force the files to be treated by the browser as if they came from a different origin?