Add favicon and remove CSRF checks
koa-csrf is conflicting with crypto.js on Heroku
The issue isn't surfacing locally, but I'll need to dig in more;
for now, the important thing is keeping the site up.