At the moment these are added in a number of places, see TODO comments with this JIRA id.

I also commented your concern a few lines down for https://github.com/wildfly/wildfly/pull/4889#commitcomment-3808535: "Do we need to use the Remoting version of this Principal - not sure if a new Principal may be better that is used both for web and for Remoting."