Generic fix for signed Cloudfront urls

Feedback welcome, it's discussed https://github.com/EFForg/https-everywhere/issues/650