I implemented the resources directory via a filter that runs before the request processor so such references shouldn't generate session cookies.
I'd like to see images be package-local since the whole idea of an APM package is that one can tarball it up, ship it to someone, and they can dump it in their packages directory without fear of overwriting any other package's resources.