add REST documentation for principals module

There's probably not a need for a `Principal` model. We might only be using a `BasicPrincipal` model when both users and groups can be returned.