only expose user's profile to client