Since the principal not necessarily is json-searializable we need to
avoid this and just pass the wanted properties to thymeleaf

fixes #799