upgrade log4j

no special reason, just seems good to have the latest (which
came out in May 2012)