Fix error reporting for payment resource.
 - actually return 400 and 401 when appropriate
Add AdditionalExpense class to `Payment`
update validation
Update tests in regards to previous commit
 - 400 and 401 returned instead of 500

 - also add test for addtional expense