Make logs directory secure, and make new applogs directory that can be written to by the app

This sorts out several problems: Apache's log directory should be
secure; logrotate can't kick apache when it runs as a normal user;
app logs should be kept apart from webserver logs.