cancan security and favicon