Respect `expose` on thrown errors

[dcherman]

https://www.npmjs.com/package/http-errors

When we're extracting the message out of a thrown error, we should consider respecting the expose property on it so that we provide consumers some way of exposing information to the client in the event that they want to return something like an HTTP 400 by using throw BadRequest('You must include an Id') from http-errors or a similar lib.

[dougwilson]

Indeed, this is already planned! An initial implementation to expose err.message for custom response messages is available on the develop branch right now if you want to test it out.

[ksathyanm]

@dougwilson Any plan for merging develop branch changes to master?