add REST documentation for principals module

`BasicUser` as well?