Makes untrusted domain error a warning.

It sends a 400 to the client, so I could even argue that it should be an error.

But currently as an admin, I'm quiet surprised that I get a 400 in the UI, and nothing in the log with the default level.

I saw this commit that explains the reason why info. But I disagree.

Feel free to close the PR if you don't agree with it.

Signed-off-by: Pierre Ozoux <pierre@ozoux.net>