allow user/host.name as valid principal