Fix #403 #445 -- avoid creating the default profile at import time

`defaultUser` is no more. It was only needed for `getProfile`, which now
creates the profile on the fly.

The code also uses `Foo.objects.get_or_create()`, which is safer than a `try`…
`except` block around `Foo.objects.get()`.

The default profile is now created with an unusable password instead of a
random one, which avoids computing an expensive hash each time
`default_profile()` is called.