oauth2: correctly handle request pairs (/ and /favicon.ico)