add user auditing

Rudimentary user auditing, albeit that we're not using ```flask.ext.login``` for logins, and ```BasicAuth``` won't populate the ```current_user``` with the principal. This will be fleshed out once we integrate with other ID providers.