Reference operations with log

This is basically @nulltoken 's #1577 but on top of the new reflog API which @vmg wanted to see. We don't need to load the reflog ourselves before writing it back out (though it still happens in the background)