Why would this not work:

a) Resources using something other than GET are automatically not affected.

b) For GET resources, require that the body of the request contains a value, perhaps from a cookie but could be anything, ensuring that the request was made using xhr, which is domain restricted.

Sounds like the simplest way to me, curious why it wouldn't work.