change ctx.error() to flag as err.expose

meaning the application could respond with this message if it likes
add err.expose check for response handler to expose the err.message