software/theia: require credentials to serve the manifest

favicon, manifest and service worker do not need to be public, for
manifest it's required to explicitly make the link use credential.