adds atomic profile update function

Yes, I added request because I don't know the old-school http-only way of sending a POST with a JSON body :-P
A more concise way to do this is:

```js
// somewhere else
var BLACKLISTED = ['_rev', '_id', 'name', 'type', 'roles', 'email', 'password_sha', 'derived_key', 'iterations', 'salt']

//here
if (BLACKLISTED.indexOf(i) === -1) doc[i] = data[i]
```

...but the safest thing to do would be to flip this around and use a whitelist that *only* copies over the known fields used for the user profile.