Shouldn't spoofed favicon link to http instead of https?