favicon, manifest and service worker do not need to be public, for
manifest it's required to explicitly make the link use credential.