I'm undecided on the implementation here. I *love* giving better details to the user, and this covers a lot of cases. BUT, it also covers the standard 404 message from the core - e.g .`No route found for "GET /api/tokens": Method Not Allowed (Allow: POST)`, which is too descriptive.

Can you think of a decent way to *whitelist* certain exception messages? I've thought of some map (seems hacky) or custom exception messages that you throw - e.g. a sub-class of AccessDenied that implements some new interface. This second idea seems nice, but it's a bit more work and doesn't cover the core exceptions. But perhaps that's exactly what we need. Just wanted a sanity heck check :)