Handle both principals: String and User

In local environment the principal must be casted to User object but in
production environment the username is represented as String in principal
object.

With this patch the application will try a cast to User object, if this
fails, it will do a cast to String - which holds the OpenID identifier.