You've caught the `abort(404)` call here, but did not tell flask to actually return a 404 response code.  The default is 200, which is the case here.