explicitly make favicon/robots publically cachable
add hostname to `__heartbeat__`

this makes it easier to know which actual host a request behind an
auto-scaling group was actually answered from