because the browser will always send the unique username to anything at that domain and path

But you could just as easily do:

    http://example.com/cookiedata/image.gif

With just a few rewriting rules.

If those rewriting rules have to be server-side, and I think that's what you mean, the answer to that is that browsers don't get to dictate terms to servers that way; browsers can say what they will and won't accept, especially in terms of content type, but URI format isn't generally something the browser can specify.