add REST documentation for principals module

Can this be changed to `Principal`, which is a union model of `User` and `Group` ?