Add some additional principal types, which can be used with realms to locate specific identities for the purpose of self-service.

Make realm implementations return useful principal values in their getPrincipal() methods which can be used for this purpose.

Make the authentication context code recognize special principals that can be used to load an identity directly from a target realm.