use _principal internally consistantly
kerberos work for broker and console

Broker key tests