SAML principal attribute release must pass through the policy

This pull request addresses issue #639
I don't understand this reference: ```/WEB-INF/view/views.xml```?