Increased some debug level in error users.

These are very annoying in instances that don't have a prefix,
as fuckers are trying PHP and other vulnerabilities non-stop.

data.c

@@ -316,7 +316,7 @@ int user_open(snac *user, const char *uid)
         }
     }
     else
-        srv_debug(1, xs_fmt("invalid user '%s'", uid));
+        srv_debug(2, xs_fmt("invalid user '%s'", uid));
 
     if (!ret)
         user_free(user);

html.c

@@ -4586,7 +4586,7 @@ int html_get_handler(const xs_dict *req, const char *q_path,
     if (!uid || !user_open(&snac, uid)) {
         /* invalid user */
         status = grave(uid, 0) ? HTTP_STATUS_GONE : HTTP_STATUS_NOT_FOUND;
-        srv_debug(1, xs_fmt("html_get_handler bad user %s %d", xs_or(uid, "(null)"), status));
+        srv_debug(2, xs_fmt("html_get_handler bad user '%s' %d", xs_or(uid, "(null)"), status));
         return status;
     }