Show a 404 for unknown files

This has the side effect of showing a 404 to unauthenticated users as
well, which is probably desirable (as to them the file is functionally
non-existent).

This also involved removing an old test that doesn't apply any more.