/api prefix, separate createProfile, uid protections