add test coverage for more unknown cases

Implements test coverage for two unknown cases and ensures a 404 is
delivered.

* add test case for GET /api/atm/1/purchases/99
    -- tests for an out of bounds purchaseId

* add test case for GET /api/atm/1/purchases/foo
    -- test for a known error