When enabling debug mode in eZ (DebugOutput=enabled), responses from the REST API do not get any more the correct http headers set.
This is inconvenient for the mimetype missing for json, but it is more inconvenient that an 404 or 403 response get truned into an 200 OK one.

The problem comes from the call to flush() in eZDebug::printReportInternal().
That call happens from within the contentx of an ob_start()/ob_end() setup, but it still flushes the http headers (nb: might be a php bug, will have to investigate further. Anyway, it happens on php 5.3)

The easy fix: remove that flush() call