OK, so I spoke to one of the researchers behind BREACH, and he indicated that he thinks the attacker is able to distinguish between headers and response body. So cookies wouldn't help. C'est la vie. I guess inserting random text into the response body would be the closest.