I know we're not using `oae-profiles` code anywhere, but we do expose some functionality in the REST endpoints. We should probably drop anything profiles related in another PR?