add REST documentation for principals module

This might be `BasicUser` as well?