use request.user.get_profile instead of naive orm hit