Update logging data for api/access log

* add to api log: duration, project
* change authtoken logging, emit only 'token' or 'form' into log