Previously almost every error that was generated, where it be by 

rb-gateway itself or a by a support library, was presented to the user

as-is. We had no distinction between a user-visible error (such as when

a requested commit or file does not exist) and an internal error (such

as when the call to hg log fails).
We now make the distinction explicit with two new kinds of errors:

InternalError, which is visible only in log messages and if

  returned in an API response will be a generic HTTP 500, and
UserVisibleError, which must be explicitly opted-in to and should

  only contain sanitized information suitable for the end user.

Both of these errors also support the new ErrorChain interface, which

allows errors to declare a cause, e.g., a user visible error that

branches could not be retrieved would have a cause that is the internal

error from hg.
Error causes are not presently returned in API responses, due to them

mostly being internal, but the entire chain will be shown in log

messages.
A few other cleanups have been made:

All error responses are now JSON instead of plain text.
Some incorrect json field tags have been corrected.

Built and ran rb-gateway. Observed errors were logged correctly.
Ran unit tests.
Failed a POST to the /session endpoint and got a JSON response.