Profile endpoint partial updated doc

let's leave this out of common, we have it in local_settings on the server, reason is that it's insecure over non-HTTPS connections.