favicon, manifest and service worker do not need to be public, for manifest it's required to explicitly make the link use credential.
