Attaching pretty straightforward patch.
There is an issue whereby auditor needs to use the Principal when
invoked from the REST interfaces. This will be fixed in a subsequent
patch. For now, for the current patch, I explicitly use
servletRequest.getUserPrincipal().getName() rather than
auditor.getUserid() to get around that.
Ade