Response status for illegal ObjectId should be bad request (400) instead of server internal (500).
Response status for null return from GET one todo item should be not found (404) instead of no content (204).