Investigate connections bypassing FPI in 78

When I visit a page by typing it's address in the urlbar, I can see one connection being authenticated with the --unknown-- username. I guess it will be the favicon. Need to investigate and fix.