implement security best practices in logging solution

[dhh1128]

• Log files should be writable only by the app creating them, and should be append-only. Readable only by root?
• Guard against log file overflow as an error condition.
• Regulations may require some info to be logged and some not to be logged.
• Failed password attempts can hold sensitive data.
• Hash sensitive data so it can be corroborated but not reversed.