Bug fixes

- Bad permit statement: was made on /PublicProfile, but should be /PublicProfiles (note trailing 's')
- JS test referred to /PublicProfile (again without trailing 's')