Use SRP challenge instead of exposing entire user collection to the public.

This update will break existing sites, but will avoid a serious security issue. The original version allowed the public to query for any user profile field and get a user id. The current version of this module allows the public to query any profile field and retrieve the full user object in the client.

This version mimics the accounts-password module to avoid exposing the user object and adds a server side white list for query-able profile fields.