I've learned, that S3 + Cloudfront + CORS + multitenant app can be tricky, if one also wants to add protection from hotlinking...