fix for "PolicyBasedAuthenticationManager doesn't care about existing

attributes" Issue 784
The ```principal``` can be ```null```: a check is required.