CallerPrincipal should be serializable

[arjantijms]

When auto apply session is used, it's highly likely (though not strictly specified as such) that the CallerPrincipal will end up in the HTTP session.

Items in the HTTP session must be serializable. Not doing that leads to errors such as reported here:

payara/Payara#3295

Do note that Subject, which is the most likely class containing principals such as CallerPrincipal is indeed serializable.

As an example, this is how Tomcat (and Tomat derived web containers, such as in GlassFish and Payara) ultimately store the authenticated Principal;

   /**
     * Set the Principal who has been authenticated for this Request.  This
     * value is also used to calculate the value to be returned by the
     * <code>getRemoteUser()</code> method.
     *
     * @param principal The user Principal
     */
    @Override
    public void setUserPrincipal(Principal principal) {
        if (SecurityUtil.isPackageProtectionEnabled()) {
            
            HttpSession session = getSession(false);
            
            if (subject != null && !subject.getPrincipals().contains(principal)) {
                subject.getPrincipals().add(principal);
            } else if (session != null && session.getAttribute(SUBJECT_ATTR) == null) {
                subject = new Subject();
                subject.getPrincipals().add(principal);
            }

            if (session != null) {
                session.setAttribute(SUBJECT_ATTR, subject);
            }
        }

        this.callerPrincipal = principal;
    }

[ggam]

Fixed by #107

[arjantijms]

Somewhere along the way the Serializable was lost, reopening this and tagging for 3.0.