Prevent XXS attack

An undefined route would return No route for ${request.head.url}, which could allow for a cross-site scripting attack. The code was change to just output Not found.