[bug 1074847] User profile API + editiable profile

This adds a bunch of fields to the user profile API, makes profiles editable by the user they represent, and adds some error handling and validation for things like making sure users cannot change their username and can't delete themselves.

This is one of the bigger API changes in a while, and has some logic in it we should double check. I think the tests cover all the logic I added beyond what DRF does.

r?