Don't Log Request URI and Query Params Directly

[alexanderkiel]

One tale of the the CVE-2021-44228 vulnerability is to not log user controlled data directly. Instead we should only already validated data. The relevant OWASP entry is Log Injection. The namespace we use for logging is blaze.rest-api.middleware.log.