KNOX-465: Initial audit record can contain leftover principal name

(cherry picked from commit 868e5715e4a3fe21c08cedfd58ba5cd67ff65fe1)