address all TODOs in `http` logging

[pq]

Currently there are a number of places we'll potentially spam stdout w/ "TODO" messages.

AIs:

• identify calls we want to log
• implement them
• remove all remaining _todo() calls