When serializing a user in the API who has private profiles enabled,
we'd try to remove some data from the resulting payload. However, if the
caller used ?only-fields= and didn't specify those fields, the
serialization process would crash. We now catch any errors here and
ignore them.

Unit tests were added to ensure this doesn't regress.

The new unit test failed before the fix, and passed after.