Hi Ralf:

I just added changeset:   8247:6747051fef79 to report the username and the
origin header value (if unauthorized) to the log line.

There is AFAICT no good way to log an IP address. Left a comment to that effect.

Also I am going to try reworking a bit of the logic in the rest flow to
require an authorized user before a bad Origin is logged. See issue2551384.
This should help cut down on log spam by unauthorized users.

I think this is done. Feel free to reopen (or create a new issue) if you disagree.