Switch API to use camelCase and extend profile

Relies on !1 (merged) (merge that first)

As frontend is being rewritten, switch the API to use camelCase. Tests need fixing to expect this.

Profile response should include isAuthorised flag if user is in appropriate lookup group. Hopefully will remove the need for groups list response.