"Since the request's allPrincipals element includes a superset of the required identities (it includes Fred, John, and Mary), there is a match." . . . . .