remove Nginx ModSecurityPass command

- move modsecurity handler to PREACCESS phase and remove ModSecurityPass command, so that nginx.conf looks cleaner:

```
location xxxx {
    ModSecurityEnabled on;
    ModSecurityConfig modsecurity.conf;
    ModSecurityPass yyyy;
}
location yyyy {
    fastcgi_pass zzzz;
}
```
becomes
```
location xxxx {
    ModSecurityEnabled on;
    ModSecurityConfig modsecurity.conf;
    fastcgi_pass  yyyy;
}
```
- fix log level
- and clean up some code