BAC-276: don't emit backtraces on production

* log backtraces instead of sending them to the client on production
* return HTTP 500 when exception is not handled