add settings parameter to exclude form parameters from error report

We need a way to prevent form values from being submitted as part of the error report, as we need to be PCI-compliant.

Ideally, we could indicate specific parameters to suppress, but this simply lets the config turn the form parameters on or off.