body was rendered in the head

to specify why users got a 404, and possibly leaking information while doing this

See discussion in #3717 for rationale on not implementing specific HTTP codes
This solves around #3717 and #3728

Adjusting travis breakage

and tries to access a show page of a non-public post