Tidy up error handling in 'expose'

Also makes the token fetching total rather than partial (correctly handles the
case where a user fails to supply the header).