Add ability to expose app and request locals as private variables

Fixes #57
update history