CORS headers missing for 404'd routes

**editor's note:** CORS headers should still happen on 404'd resources...

_edit: please close this issue. I was calling `https://wzrd.in/standalone/react-redux@latest.js` instead of `https://wzrd.in/standalone/react-redux@latest`. My apologies._

I'm getting:
```
(index):1 XMLHttpRequest cannot load https://wzrd.in/standalone/react-redux@latest.js. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://robbiemu.github.io' is therefore not allowed access. The response had HTTP status code 502.
```

which is weird because when I load the url directly I see a cors response header in the network tab:
```
Access-Control-Allow-Origin:*
Connection:keep-alive
Content-Length:77297
Content-Type:text/javascript
Date:Thu, 27 Apr 2017 18:39:38 GMT
Server:nginx/1.11.3
Strict-Transport-Security:max-age=31536000; includeSubDomains; preload
X-Powered-By:Express
```

The report concerns CORS behavior for the wzrd.in standalone endpoint, with the original request using /standalone/react-redux@latest.js and the corrected endpoint omitting .js. Reproduce the request and inspect how 404 responses are handled; done would mean the intended endpoint behavior and CORS headers are verified, but the issue requests closure because the original URL was mistaken.

Written by the indexing model from the issue text.