GeoJSON.get() and MVT.get() views have side effects

[jacobtylerwalls]

Was reading up on CSRF today and recalled that HTTP GET requests shouldn't have side-effects (and for that reason aren't protected against CSRF).

We have a couple GET views that save UserProfile rows:

arches/arches/app/views/api.py

Lines 179 to 180 in 3e54931

	if hasattr(request.user, "userprofile") is not True:
	models.UserProfile.objects.create(user=request.user)

arches/arches/app/views/api.py

Lines 275 to 276 in 3e54931

	if hasattr(request.user, "userprofile") is not True:
	models.UserProfile.objects.create(user=request.user)

I can't see any attack vector here, so this is just a cleanup opportunity. We seem to be doing this merely for the sake of calling the UserProfile.viewable_nodegroups property. Creating a db row just for the sake of calling a function is something we can avoid: one, to be more RESTful, and two, to shave off a db query.