[webui] Disable create button and use public route

for icons.
The controller needs to be accessible for not logged in users otherwise interconnect won't work.
However, the create button needs to be disabled and retrieving the icons needs to happen
via the /public route, otherwise backend requires login to access the page.
Fixes #2619.