Browser requests to /favicon.ico were hitting the auth middleware. Added explicit route + auth bypass.