Add debug logging for endpoints that don't have a user but affect a user

[arianvp]

E.g. this is useful to see if someone is actively trying to reset
someone's password.

[tiago-loureiro]

For the future though, I think we should move all these log calls to a separate function like:

auditLog :: (MonadLogger m) => UserId -> [UserId] -> String ->  m ()
auditLog actor targets action =
  -- We probably want a different log level
  Log.debug $ field "user" (toByteString actor)
            . field "targets" (map toByteString targets) -- "with an intercalated comma..."
            . field "action" (Log.val action)
            . msg "a little more descriptive"

Even potentially we want a different log level or something along these lines...