login asks for permissions, api call made when loading profile
merging profile.html