added favicon
fixed security hole by not really testing for main admin in is_main_admin decorator