CMS-4299 Implement principal (and key).
Moved security classes back to wem-core and wem-api.