Ensure appropriate logging hooks are enabled for failed sign-ins

[mindok]

As per OWASP recommendations (https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/) there should be sufficient hooks around logins (success & failure), token access, logout and password changes to allow capture and logging of these events.

The hooks should allow for injection of application specific context. For example, obtaining a "reasonable" client IP address depends on the specifics of how the application is hosted, and typically security related logging events should be offloaded to a logging infrastructure that is totally separated from the run-time infrastructure.