Put them in package/www/resources/...
Refer to them as /resources/package/...
Not sure if it avoids a session_id, though ... would you care testing?