404s were not being correctly returned with CORS headers from the server handler