add REST documentation for principals module

Probably `BasicUser` as well