What is "principal"

The main one is the user currently connected in the application. However, you retrieve it through the security context that is linked to the current thread and as such is also linked to the current request and your session.