This is a catchall handler for unmatched requests - it doesnt require auth