Fix several issues with the private profile support.

Private profiles broke unit tests, and weren't testing properly to determine
if the profile could be viewed.

We now have a single function for testing if a profile is viewable,
which is User.is_profile_visible(). This takes an optional user.

The "admin" test user is no longer private by default (which broke tests).

The ID on the User resource is no longer hidden (which can break things,
and is pointless given that the ID is known through the URLs). It also
removes the name/e-mail fields, instead of setting them to an empty string.

Unit tests pass, including the new one added to make sure we get the right
result when querying visibility.