It returns the user prinicpal. This is required by the webui, as the Kerberos credential mechanism in http does not expose the cleartext prinicpal to the web browser.
