Review publications with Meteor.user utilizing Account.server

[Capt-Slow]

This ticket is in reference to #344.

Publications using Meteor.user utilizing Account.server maybe exposing sensitive info to the client.

Account.user Could be refactored to apply exported fields to all in the short term, and a larger refactor in adding public social profile data to ReactionCore.Collections.Accounts.

[aaronjudd]

I believe these are the only fields (meant to be) exposed:

    "emails": 1,
    "profile.firstName": 1,
    "profile.lastName": 1,
    "profile.familyName": 1,
    "profile.secondName": 1,
    "profile.name": 1,
    "services.twitter.profile_image_url_https": 1,
    "services.facebook.id": 1,
    "services.google.picture": 1,
    "services.github.username": 1,
    "services.instagram.profile_picture": 1

and this should only be exposed to the user whose account this record belongs to, or to admin users.