use error.status as convention (match suggested error handler for express)

defer error response to error handler (so the application can override response behavior).