Internal error details should not be shown to the user

[stuartwdouglas]

If we are returning an error on a HTTP request we should not be returning the details of our internal error, as this is a security risk (except in dev mode).

An alternative is to generate a unique error id that we include in the error message and the logs, so we can correlate a users error message with logs in DD.

[stuartwdouglas]

Looks like this should be fine now, as it was fixed in #2162

If an explicit error body is returned then it is still shown, but I think that is fine.