<link rel="shortcut icon" href="/path/to/favicon.ico" />
Personally, I'd rather require the files to be in known locations than force every client that wants the information to make a request and parse HTML.
Of course, many people end up putting an explicit reference in anyway, so, eh. Probably not that helpful.
The 404 errors in particular seem like a very Machiavellian way to get sites to support your browser's features. You have to wonder how many people add in a favicon or iTouch icon just to shut up the errors up.
1. Users are assigned a session cookie when they land on a PHP page. A CSRF token is associated with a session when users visit the login page.
2. Favicon requests were going to PHP instead of a static resource. Normally that's fine, since PHP will see the cookie.
3. But since the request looked like it was for a static resource, Varnish stripped the cookies before passing it back to Apache/PHP. That meant PHP issued a new session that replaced the old one.
All in all, a very tricky interaction between technologies (especially since Chrome didn't display the favicon request).
The problem is easily resolved by having Apache respond with a 404 to any requests for non-existant static resources. Which is of course what it should be doing in the first place.
Firefox, for example, quickly gives up if it can't fetch a resource, and so would fail but then work a second time. A glitch like that could easily be overlooked as a mis-click or network error.