scrub sql error messages from json_responses

Do not expose any internal schema / access control messages in the response object. Also i couldn't differentiate between 403 errors and plain 404's with non-existant ids. Open to ideas here but i thought straight up 404's are actually a succint response (unless you believe you do have access rights).

@brian-c not sure if you raised an issue for this but this may completely close the issue with SQL debug statements in the json response object.
yep