freeze our package versions

Because we developed this site on Django 1.4, when I tried to download
all the packages, EVERYTHING broke cause it got Django 1.7, South
1.0... So I grabbed the package list from the server and froze it into
requirements.txt. These are probably hilariously out of date, but for
now they will suffice.
add _ to reverse route for profile, fixes #13

All the username characters were in there, except for _. Then someone
showed up and put an underscore in their username, and crashed the
directory page.