if user not found, return 404