Change haproxy to log to unix domain socket

The trusty haproxy package explicitly setup a /dev/log socket in
haproxy's chroot environment.  Makes sense for us to use that.
Switch galera over to active/passive

The first controller specified will recieve all connections until there
is a failure, then one of the remaining backups will recieve all writes.
This is to work around the issue described here:
http://lists.openstack.org/pipermail/openstack-dev/2014-May/035264.html