This PR refactors accessing and updating of profile data from
`/api/profile` in the store:

 - Always access the profile data fetched from `/api/profile` via the
   `store.profile()` selector rather than using
   `store.getState().session...`.

 - Move the profile data from the top level of `state.session` into a
   `profile` field (`state.session.profile`)

 - Rename `store.updateSession()` to `store.updateProfile()` for
   consistency with the `profile()` selector. The previous name is a
   holdover from when "session" meant "the user's cookie session".

These changes make this store module follow our agreed best practices to
avoid accessing state directly, rather than via a selector, and will also
make it easier to add additional session-related state in future which
is not fetched from `/api/profile`.

One subtle but intended change is that `state.session.profile` is now
always _replaced_ when the profile is udpated, rather than it being the
result of merging the previous and current state. The previous behavior
could introduce subtle bugs where state from a previous login remained
after switching the user.