Explore prototype/parameter pollution with lodash.merge and an EJS SSTI chain.

• Profile updates use POST /update-profile