Covenants belong to users, not profiles. Doh!
Getting there - TODO fix security component
Fixed security issue - cake 1.3.18 breaks .htaccess