simplify icon strategy to avoid requiring "management" permissions, and avoid load-time blink