SI: Limit resources eligible for integrity validation.

As discussed in [1], we ought to limit the ability of attackers to read
resource values cross-origin via brute-force attacks using the integrity
validation mechanisms. This patch implements lcamtuf/mnot's suggestions
in this regard.

It's possible that we ought to make this even more stringent by dropping
the "publically cachable" bits in favor of strict CORS checking. That
will certainly be a topic of discussion going forward.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2014Jan/0025.html