[logging] Log identity as part of API call logging

[cjllanwarne]

Change Description

• Adds the username dict to requests during auth checks
• Adds logging of that username dict (if available) during call logging

Security Assessment

• This change has a medium security impact

Impact Description

• Makes usernames explicitly visible in the system logs, so admins are now able to track what individual users are doing or looking at.
• The userdata in request objects should be handled carefully, though it does not include anything secret (ie nothing which would allow impersonation if leaked)

(Reviewers: please confirm the security impact before approving)

[patrick-schultz]

Looks good, just a minor code style suggestion.

[patrick-schultz]

I think this can be simplified to something more pythonic like (untested)

id_keys = ['username', 'login_id', 'is_developer', 'hail_identity']
extra.update((k, userdata_maybe[k]) for k in id_keys if k in userdata_maybe)