no error but blank 404 out on maliciously formed calls