Return more detailed errors

[discordianfish]

We should more detailed errors. Right now we often return generic errors to avoid leaking internals outside. For validated payloads though, we can just return everything we know since it will be only visible to someone who has the token.