Report errors to caller via HTTP

[mbr]

A good enhancement is to make errors available clearly as an HTTP payload when they occur. Since errors are potentially sensistive, multiple models come to mind:

• Only report them when authorized via master key
• Add an additional header to make them visible, i.e. second authorization other than the primary one
• Add a configuration setting that makes errors visible
• None of the above, and only log them