Cached login eviction fix

`getAuthenticationCacheKey(principals)` must return the exact same value as the return value from `getAuthenticationCacheKey(authenticationToken)`.

I see that we're explicitly referencing 'email' here - what happens if they tried to login via username instead of an email address?  This wouldn't work, correct?  Or am I missing something?

Thanks for any clarification!