Don't let anonymous users update user profiles.
Add location to profile API.

BB-390