make user profiles publicly accessible, resolves #331

can we `assertNotContains` email here too?