I have a server A that loads / serves an html page, that page loads resources (js,css, img files) from a server B. What would be the most secure architecture that would prevent direct access to resources on server B unless they are requested via browser from html page from server A?