don't bother with cookie/session checks for 404s