implementors should employ response sanitization

[BenGardiner]

implementors should have response sanitization to ensure that responses from the the open api instance do not contain any secrets. at least:

• passwords
• tokens or keys used for upstream (if this is a bridge instance) or other TSP internal services (if this is an integrated instance)

if returning secrets is required for a particular endpoint, then an exception should be made

This is related to #22 -- which could be resolved by sanitizing responses for stacktraces also

Also, the separation of PII designed by account role segmentation could also be shored-up with response sanitization.