#3 tests for controller done. @AuthenticationPrincipal is not! injected into controller methods as i could not get it to work. but thats not significant when testing just the web layer. might be a problem when doing full integration tests