fix NPE in decoding user url cookie
annotations: new @Principal parameter annotation to specify you want the current user in controller methods
adding to milton-mini