REVIEW: Set userId in MDC on login

I'm not sure if there is a better place for this, but the current strategy to set the userId in MDC via SecurityFilter is problematic as this happens too early.  I think that code is still needed however to set the MDC once you have logged in and have a session though.

Also updated the logic to detect if  UNKNWON_USER_ID is set and attempt to reset in that case.