Switch remoteUser to principalUser

This is kind of a sweeping change to support having identified
principals (= person who is using the site) who are not users (people
who have an account on the site).

It entails changing the authentication methods to set different
properties on the request, and checking those properties in the API code.

It's mostly working, but there seems to be some problem with the
finishers which I'm going to fix right away.
Use req.principal for sanitizing activities

We were passing the req.principalUser to the Activity class to set
context for sanitizing. Instead, we now pass req.principal, in case
there is no principalUser.
Use principal rather than remoteUser in finishers
Use principal in logging and default variables
Session middleware sets locals for principal and principalUser
Use principalUser and principal in web routes
Use principal and principalUser in templates
Set principal and principalUser for client-side rendering