better specificity of principle object in client filter
added passthrough of userinfo for remote OIDC users
moved OIDC auth token and userinfo interception filter to common package, addresses #353