Start refactoring of users->profiles
Expose the user model as editable, not the profile

This hides the pretty incidental profile id, and thus nicely maps to the
JS ids.