Add logging to antiforgery

[rynowak]

We should add logging

Some ideas:

• Validating a token (verbose)
• Validation failure / missing token (warning)

Thinking warning is right for failures, because generally this is a app configuration issue.

[Eilon]

Yeah this is hugely important, and I agree with the proposed log levels.

[rynowak]

Had some discussion and this is what we came up with.

IsRequestValidAsync(..) will log success (debug) and failure (warning)
ValidateRequestAsync(...) will log success (debug) - failure is covered by an exception
GetAndStoreTokens(...) will log whether a token was reused or generated (debug)

[ryanbrandenburg]

@dougbu would like to also add logging around the decisions to generate or reuse tokens in SetCookieTokenAndHeader, GetTokens->GetTokensInternal and SetCookieTokenAndHeader. Will circle back around to it after he makes the changes to that area he's working on in #23

[Eilon]

Done done done done... (like, Beethoven style)