Move principalID and principalIDNS from URL to Authorization Header.