add REST documentation for principals module

Actually, it looks like this sets the `large` picture of the group only.