diff --git a/api/resolver/resolver.go b/api/resolver/resolver.go
index 2e23d62e..12854b19 100644
--- a/api/resolver/resolver.go
+++ b/api/resolver/resolver.go
@@ -2,9 +2,15 @@
 package resolver
 
 import (
+	"errors"
 	"net/http"
 )
 
+var (
+	ErrNotFound    = errors.New("not found")
+	ErrInvalidPath = errors.New("invalid path")
+)
+
 // Resolver resolves requests to endpoints
 type Resolver interface {
 	Resolve(r *http.Request) (*Endpoint, error)
diff --git a/api/router/registry/registry.go b/api/router/registry/registry.go
index 375aa7d0..c024424f 100644
--- a/api/router/registry/registry.go
+++ b/api/router/registry/registry.go
@@ -325,7 +325,7 @@ func (r *registryRouter) Endpoint(req *http.Request) (*api.Service, error) {
 	}
 
 	// no match
-	return nil, errors.New("not found")
+	return nil, registry.ErrNotFound
 }
 
 func (r *registryRouter) Route(req *http.Request) (*api.Service, error) {
diff --git a/api/server/auth/auth.go b/api/server/auth/auth.go
index 7e86f651..68e7f7a3 100644
--- a/api/server/auth/auth.go
+++ b/api/server/auth/auth.go
@@ -53,11 +53,19 @@ func (h authHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 
 	// Determine the name of the service being requested
 	endpoint, err := h.resolver.Resolve(req)
-	if err != nil {
+	if err == resolver.ErrInvalidPath || err == resolver.ErrNotFound {
+		// a file not served by the resolver has been requested (e.g. favicon.ico)
+		endpoint = &resolver.Endpoint{Path: req.URL.Path}
+	} else if err != nil {
 		w.WriteHeader(http.StatusInternalServerError)
 		return
 	}
-	resName := h.namespace + "." + endpoint.Name
+
+	// construct the resource name, e.g. home => go.micro.web.home
+	resName := h.namespace
+	if len(endpoint.Name) > 0 {
+		resName = resName + "." + endpoint.Name
+	}
 
 	// Perform the verification check to see if the account has access to
 	// the resource they're requesting