abort(404) if operation type not allowed

If operation provided in the url is not in allowed list, then url is
actually invalid and hence abort 404.