Who is the principal supposed to be when a session object is unbound via HttpSessionBindingListener.valueUnbound() ?