These originate from "report-uri" (not "report-to") tags in CSP
headers, and appear as application/csp-report requests.

Also, stop logging the client IP for email reports, where it's just
going to be some email provider's reporting infrastructure.