Fix permission
Identify user to get by his id, not session cookie
Cleanup code with/for @markijbema
Integrate user profile into user's serializable hash