Minor changes

- Updating npm deps
- Removing 'allow' header on 404s