add ico extension to be handled in unathenticated/authenticated as well