[FIX] /web/binary/{image,saveas}: use request.registry instead of deprecated `request.session.model`

This makes the controllers work also for
public users, e.g. in the frontend.
[FIX] website_forum: avoid access error when closing spam/abuse questions

Logging the user login is not necessary, but
accessing it might cause access errors. Logging
the UID is equivalent anyway, so let's not bother.