logos only

Based on a conversation today with @isaacs and @seldo, this PR applies limits so only a few files will actually be served:

- The package.json file itself
- The file specified as  `icon` in package.json