Should API 500 responses return raw exception messages?