Convert principalId to String

When principalId is a object, for example, ObjectId in MongoDB, ACL.checkPermission always load empty dynACLs, this add can fix it. Also make tests passing described in issue #245.