avoid NPE, return 404 instead

fixes #256