Less verbose error messages

[ignatiusm]

Some error messages (e.g. PATCH /api/users/9 when sending bogus information) reveal information about the expected fields: "Role should be one of the following..."

This is not a desirable behaviour. Need to not expose validation constraints

[ignatiusm]

resolved in #880