fix: don't echo request back for unknown endpoints

closes #998

server/api/index.test.js

@@ -0,0 +1,22 @@
+/* eslint-disable flowtype/require-valid-file-annotation */
+import TestServer from 'fetch-test-server';
+import app from '../app';
+import { flushdb } from '../test/support';
+const server = new TestServer(app.callback());
+
+beforeEach(flushdb);
+afterAll(server.close);
+
+describe('POST unknown endpoint', async () => {
+  it('should be not found', async () => {
+    const res = await server.post('/api/blah');
+    expect(res.status).toEqual(404);
+  });
+});
+
+describe('GET unknown endpoint', async () => {
+  it('should be not found', async () => {
+    const res = await server.get('/api/blah');
+    expect(res.status).toEqual(404);
+  });
+});