add REST documentation for principals module

Same as above. It doesn't really set the profile picture, it creates the large picture only, which will then need to be cropped.