don't authenticate favicon
use authcookie for authentication