Lock down /profile/* routes