Fix bug with user objects in authenticated requests (ARS strings

in message bases weren't applied to the user correctly)
Add HTTP logon/off log entries.

src/sbbs3/websrvr.c

@@ -1003,9 +1003,14 @@ void http_logon(http_session_t * session, user_t *usr)
 {
 	if(usr==NULL)
 		getuserdat(&scfg, &session->user);
+	else
+		session->user=*usr;
 
 	if(session->user.number==session->last_user_num)
 		return;
+
+	lprintf(LOG_INFO,"%04d HTTP Logon (%d)",session->socket,session->user.number);
+
 	if(session->user.number==0)
 		SAFECOPY(session->username,unknown);
 	else {
@@ -1023,6 +1028,9 @@ void http_logoff(http_session_t * session)
 {
 	if(session->last_user_num<=0)
 		return;
+
+	lprintf(LOG_INFO,"%04d HTTP Logoff (%d)",session->socket,session->user.number);
+
 	SAFECOPY(session->username,unknown);
 	logoutuserdat(&scfg, &session->user, time(NULL), session->logon_time);
 	memset(&session->user,0,sizeof(session->user));