Dont include http response in upload error

* this error gets exposed to the user, and can leak important
  information such as basic auth creds
* log the http response internally