ensure that 404 and 500 have CORS for the API, including DEBUG mode (bug 1068353)