Also discussed previously in #213 (Github Pull Request). shared-secret-auth and rest-auth logging is still at `INFO` intentionally, as user login events seem more important to keep. Those modules typically don't spam as much.
Slavi Pantaleev