Profile information is globally viewable

[dburgoyne]

By explicitly specifying a user ID in the query string, any user can view any other user's profile page. This also allows a user to indirectly determine the total number of if-me users.

Steps to reproduce:
Log in as any user and make a GET request of the form http://www.if-me.org/profile?userid=N, where N is any integer. If a user with ID N exists, their profile page will be returned. Otherwise, HTTP 404 is returned.

[jzshen]

Should users have a username then to counteract the problem?

[julianguyen]

That shouldn't be necessary. I refactored the model for users and allies so that this problem is fixed. Let me know if it isn't though.