render 404 for 404 errors
proper join for private self-owned study access