handle some missing defaults better

Not needed. Many other aspects require defaults correctly loaded.
Addressed in next commit.
profile password handling

don't default password
save password via setPrev()
strip password before saving to public store
attempt to inject password via getPref() when getProfile()
update fancy-settings