scrub sql error messages from json_responses

Do not expose any internal schema / access control messages in the response object. Also i couldn't differentiate between 403 errors and plain 404's with non-existant ids. Open to ideas here but i thought straight up 404's are actually a succint response (unless you believe you do have access rights).

@brian-c not sure if you raised an issue for this but this may completely close the issue with SQL debug statements in the json response object.
Super nitpicky can this be 'resource'?