What's more interesting - have a look what this Cloudflare's own support page says:

CloudFlare will add a security cookie to any domain or subdomain that is being proxied by our service. In addition, since CloudFlare is already caching your static content by default, there really is no need to have a cookieless domain.

1. Steven,
2. After checking the URL you PM'ed it's clear that your site gets cached by Cloudflare at their servers.
3. Below is an an excerpt of the superfish.css network report at General and Response Headers tabs taken from Google Chrome dev tools console:
   1. General:
4. Remote Address:
   ----------------------
   
5. Request URL:
   https://-------------------------------/superfish.css
6. Request Method:
   GET
7. Status Code:
   304 Not Modified

1. Response Headers:

1. cache-control:
   public, max-age=604800
2. cf-cache-status:
   HIT
3. cf-ray:
   2076e0edc7701aa5-DUS
4. date:
   Fri, 17 Jul 2015 15:11:18 GMT
5. etag:
   "0dd6fb1df55cf1:0"
6. expires:
   Fri, 24 Jul 2015 15:11:18 GMT
7. last-modified:
   Fri, 11 Apr 2014 23:42:26 GMT
8. server:
   cloudflare-nginx
9. status:
   304 Not Modified
10. vary:
    Accept-Encoding
11. version:
    HTTP/1.1
12. x-powered-by:
    ASP.NET