You're suggesting moving this functionality to updateOwner()?  I see a few reasons for not doing this.
* Putting it in updateOwner() would require providing a content body which makes it a little more tedious to turn logging on and off.  As it stands it's just a very simple curl command to turn logging on and off.  ```curl -k -u admin:blahblah -X PUT  https://localhost:8443/candlepin/owners/donaldduck/log``` and then just change the HTTP verb to DELETE to turn it off.
* Having it as its own distinct call allows people to blacklist the functionality if they want.  Like, I imagine some people might want to just completely deny that call unless it comes from localhost or something.
* With a distinct call all the auth checking is handled by the interceptor for free.  If we merged it into updateOwner(), we'd have to have a check in the method to see if you are a super-admin or not.