centralize principal visibility in principals service
add changePassword to principal services