use principal from request context (not default ClaimsPrincipal.Current)