if (principal.picture.smallUri) {
    principal.picture.small = ContentUtil.getSignedDownloadUrl(ctx, principal.picture.smallUri, duration, offset);
    delete principal.picture.smallUri;
  }