CloudFront doesn't handle CORS properly (https://forums.aws.amazon.com/thread.jspa?messageID=377513). hard-coding the font paths to S3