At least they should allow it for root domain to access subdomain's. I put all static files in a subdomain to make them free of cookies, but such restriction makes things difficult.