do not expose illegal status

make http-assert the same logic with koa.

another is `merge(err, opts)`, in koa's `ctx.throw`, it will ignore `status`, `expose` in opts, http-assert won't. 

seems both make sense to me, but can we make these also as the same logic?