you should host this on a separate domain because your clients are setting cookies on your domain and when I hit one of your hosted js files I see all of those cookies

for eg. I can see techcrunch and metric fuckton of google analytics cookies

separate this from the cloudfront clients or you have a potential security problem and a definite privacy breach