add 404/500 middleware