This is JS specifically in Cloudflare's own domain is it not? I don't think you need to enable JS after. So a JS / cookie blocking setup should be versatile enough to let you allow only Cloudflare JS and cookies which are then self-destructed.