catch the user code panic and send 500

optionally, and off by default, it includes the stack trace in the response payload.