Add config property for exception messages in API responses

Execption messages in API responses is disabled by default because they
can contain sensitive data. The config property
`api.expose-exception-messages` has been added and is described in the
developer documentation.