Improve coverage

What happened is that since I allowed CORS on `/\.*/`, I *always* received a `Method Not Allowed`, on all routes, even where I wanted to receive a 404... I don't know if there's a better way to handle that?