ensure that 404 and 500 have CORS for the API, including DEBUG mode (bug...

... 970641)
I don't really have a good suggestion, but `debug` sounds like a poor name, it does not indicate what the variable is for.