Onebox, favicon's and Cloudflare's "Hotlink Protection"

I added .ico to authorized extensions and rebuilt the HTML of a post and while the favicon wasn’t downloaded and served locally straight away it was when I checked it a couple of days later.