Deleting users/groups orphans Principal

When a User (or presumably Group, but I didn't test that yet) is deleted, we're using:

```
def doDeleteUser(self, login):
session = Session()
user = session.query(self.user_class).filter_by(login=login).first()
if user is None:
return False
session.delete(user)
notify(PrincipalDeleted(user))
return True
```

Unfortunately this leaves the user on the Principal table, and it's no longer possible to re-add the user. Surely when deleting either groups or users, we should be deleting the principal object (and I don't understand the SQLAlchemy ORM well enough yet to know whether we should do that directly or via a backref).