There really should not be a method that returns _all_ principals, especially since the list of all principals is never used. Instead, this method is used in two places, where a specific principal needs to be validated.