304 shouldn’t be a problem, as it just means that the cached version hasn’t changed. If you are modifying files and want to force them to change, try adding a cache buster to the URL when referenced, e.g. “?v=”.

You might want to incorporate this into your build process. More recently I have been concentrating on client side development, using the IonFar Migrations library, see my blog post https://sgryphon.wordpress.com/2015/09/02/sharepoint-online-continuous-deployment-with-ionfar-migration/ — if you follow the links to the project and look at the ‘TestApplication’ example you will see in the synchronise section how the hash can be automatically included in the scriptlink.

The 401 is different; it would apply to unauthenticated users. Note that all files loaded into SharePoint document libraries are protected by authentication, so they aren’t accessible from non-SharePoint pages. If this is the case, consider option iii, to store the script files on a separate content distribution site. A separate site would be accessible both to authenticated and non-authenticated users.