Move authentication failed logging to checkPassword

This PR moves the logging for invalid login attempts to `checkPassword` where it should be called all the time. Not the cleanest solution but does it's job (TM).

Furthermore:
- `log_authfailip` have been removed. This settings is insane and defaulting it to false was even more.
- The `X-Forwarded-For` header is now logged too. What the server admin does with this information and whether he trusts it is not our department ;-)

Testplan:
- [ ] Login via WebDAV with invalid credentials => logged
- [ ] Login via WebDAV with valid credentials => not logged
- [ ] Login via form with invalid credentials => logged
- [ ] Login via form with valid credentials => not logged

Fixes https://github.com/owncloud/core/issues/10366

@karlitschek I'd propose that we backport this to stable7 but not stable6 (logging format has changed a little bit - I don't want to embarrass EE customers but for CE mentioning this prominently in the changelog should be enough). What do you think?