always use https for favicon for simplicity