use url_for to serve static files, prevent favicon request