add REST documentation for principals module

This doesn't really set the profile picture for the group. It uploads a picture that can be cropped. It's only the cropped picture that will be set as the profile picture.