AbstractSPFormAuthenticator has NPE if principal is null

======
// Redirect the user to the originally requested URL
if (saveRestoreRequest) {
// Store the authenticated principal in the session.
session.setNote(Constants.FORM_PRINCIPAL_NOTE, principal);
==========
If principal is null, there is a NPE. Check for null principal