Why is Envoy sending 404s to CONNECT requests?