Absense of favicon & 'force https'

Maybe it should just be enabled by default? Maybe it’s better to just be broken if they somehow try not to use https.