ensure that 404 and 500 have CORS for the API, including DEBUG mode (bug...

... 970641)
I'm still not sure about `fireplacey` and what that's about. To be honest I'm tempted just to say we should CORS all API calls for everything.