ensure that 404 and 500 have CORS for the API, including DEBUG mode (bug...

... 970641)
You should be able to use `request.API` instead of `request.path.startswith('/api/')`.