[ADDITION] Basic security logging

adds /logs folder to root dir
.htaccess to block access to the logs in root dir (errordocs /logs and -indexes)
by default, only logs warnings
config check to see if that folder is writable

adds 4 new security config options for `logging`, `enabled`, `level`, `path`, and `file`
adds a new security config option `protect_session_state`, disabled by default

 * warning if changeNoFee is used
 * warning if setLocked is used
 * warning if changeAdmin is used
 * warning if when logging in that IP is different than saved IP
 * info if a login fails with bad user or password
 * warning if a user is locked via failed logins
 * info if an update/etc fails with bad pin
 * warning if a user is locked via failed pins
 * info when a pin request is sent
 * warning when a pin request email doesn't send
 * warning when trying to request pin reset and incorrect password
 * info when a twofactor token sent
 * warning if twofactor email doesn't send
 * warning when a user tries to request multiple of the same type of token
 * info when a twofactor token is deleted
 * warning if a twofactor token fails to delete
 * warning when an invalid change password token is used
 * info on successful account update
 * warning when reset password is called and IP doesn't match saved IP, info otherwise
 * warning if isAuthenticated falls through and kills a session
 * info when an invitation is sent
 * warning if invitation email doesn't send
 * warning if invitation token fails to delete