KNOX-465: Initial audit record can contain leftover principal name