The update/delete routes now deal with 404, i.e. document not found by ID. An invalid Mongo ID still yields a 500 (must be a single String of 12 bytes or a string of 24 hex characters). If this were an API it should maybe be a 422 (unprocessable)