Actions have $this->scoped as the current profile which we can gladly
replace all the $cur=common_current_user() with.

And we want the prepare/handle functions to be protected. Plus only
the prepare function uses $args (which _must_ be an array).