Modify to use SRP challenge and avoid exposing user details.

The existing implementation was very insecure, allowing anyone to
query the entire user collection by any profile field and retrieve
the full user document back.

This version uses and SRP challenge same as the accounts-password.

It also requires the app to whitelist a group of profile fields
which may be queried by the client exposed method.