Robustify the unsuccessful login logging.

Currently if someone nefarious messed with the params such that
`params[:user][:email]` was a hash instead of a string, this logging
would blow up when trying to lookup the attempted user.

And before anyone says anything, robustify is a perfectly cromulent
word.
Merge pull request #276 from alphagov/robustify_unsuccessful_login_logging

Robustify the unsuccessful login logging.