Or require crossorigin="anonymous", maybe in combination with Cache-Control: public.