return 404 for DELETEs to nonexistent/inaccessible resources

Idempotency only means that subsequent identical requests cannot have
additional side-effects. Since the response code is not a side effect,
but rather a return value, `DELETE` should respond with `204` only if
an object is deleted, and with `404` when nothing is deleted.

(It is very confusing if an API returns `204` to a DELETE for a nonexistent
or inaccessible resource.)