Apps may define custom TMLs to show HTTP errors like 404.
This custom error page however should not be displayed if the app is not direct accessible for the current user. This now has been corrected.