Don't send arbtarty user input back to the client in the 404 error case.

While there's probably protection against in elsewhere in the stack, this could be an cross-site scripting vector.  Nesus thinks so via this plugin: http://www.tenable.com/plugins/index.php?view=single&id=10815