Protect user profiles with ML security

[grtjn]

proxy.js currently contains special measure to safeguard against profile updates on other users profiles. I think it will make things easier if we simply disallow updating user profiles (with protected collections or such), and force the ui to use an amped rest extension to do profile updates.

[janmichaelyu]

@grtjn , by amped rest extension do you mean a new rest extension needs to be created and the profile route will only use that new extension?

[grtjn]

Yes. Some profile rest extension which is amped itself or uses an amped function to access docs in uris/collections otherwise restricted..

I think we used to have something like that in demo-cat at some point..

[janmichaelyu]

PR #334