OK - got it!
I was concatenating stuff to make up the message:
sErr = "Invalid URL parameter. One of the IDs you passed " + oObj.rec_id[i] + " was too short it should be a UUID with a length of 36";
That is OK - but when you throw the error - you have to cast it as a string:
throw[400, sErr.toString()];