Add /api/profile (unlocked)