return principal when generating token & require principal for revoking token and header authorization