refactor with http-errors

cc @eivindfjeldstad @jonathanong 
and what's the priority of `status`, `err.status` and `props.status`. what about `expose`. :(

```js
var _err = new Error('request error');
_err.status = 500;
createError(400, _err, {
  status: 404,
  expose: false
});
```