Optional "rules" file specifying regexes (or explicit names) of principals which may be created; anything unmatched results in a 403 Forbidden.
Updated readme to reflect principal-names-rules feature.