fix PUT /profiles/{id}

allow card and/or bank to be blank

include csrf token with PUT request