change ctx.error() to flag as err.expose

meaning the application could respond with this message if it likes

docs/api.md

@@ -534,6 +534,12 @@ err.status = 400;
 throw err;
 ```
 
+  Note that these are user-level errors and are flagged with
+  `err.expose` meaning the messages are appropriate for 
+  client responses, which is typically not the case for
+  error messages since you do not want to leak failure
+  details.
+
 ## Error Handling
 
   By default outputs all errors to stderr unless __NODE_ENV__ is "test". To perform custom error-handling logic such as centralized logging you

lib/context.js

@@ -556,7 +556,8 @@ module.exports = {
 
   /**
    * Throw an error with `msg` and optional `status`
-   * defaulting to 500.
+   * defaulting to 500. Note that these are user-level
+   * errors, and the message may be exposed to the client.
    *
    *    this.error(403)
    *    this.error('name required', 400)
@@ -576,6 +577,7 @@ module.exports = {
 
     var err = new Error(msg);
     err.status = status || 500;
+    err.expose = true;
     throw err;
   },