Return 404 instead of 500 if CORS enabled. Closes #381.