Reduce database queries when returning the User list resource.

The User API resource checked profile.is_private on each User being
serialized in a list, which is expensive. Unfortunately, neither
select_related() nor prefetch_related() appear to properly cache reverse
ForeignKey relations, so they don't help us with this.

The best solution, it seems, is to tack on an extra query for our users,
storing the result of Profile.is_private on the User. The
is_profile_visible function checks for this, and attempts to do the
right thing by making use of that value, if it's available.