You were right about the nginx
The ico issue persists though, recently upgraded to 1.12.2 and uploading ico files still fails despite whitelisting them in the extensions field.
After disabling the isImage check (in src/controllers/uploads.js), then it works flawlessly. I suppose this isn't a big issue since we don't need the size checks and all that stuff on image uploads.
But it would be nice if uploading .ico files could work without having to edit the source.