Profile statements i18n

Implements #2669 and closes #1659. Also refactors and cleans up a lot of stuff, including some of the JS code.
This makes me really nervous. We have some assurance that `self.id` won't contain a SQL injection. What assurance do we give ourselves that `langs` won't contain a SQL injection?