Add namespace support

This requires lots of changes because we have to swap to using Principal
everywhere (and namely in MemberIdMapping).