fix(server): return a 404 when no user is found

 fixes #711