login should return principal