Remove the Principal field from the request

The server will always overwrite this field with the username obtained from
the auth provider. Allowing the client to set it is a waste of time.