Currently, a user can not sign up and pass profile properties. This will fail

account.signUp({
  username: 'pat',
  password: 'secret',
  profile: {
    fullname: 'Dr Pat Hook'
  }
})

The reason is that JSON API currently does not allow for multiple actions in a single request

So we need to send a separate request to PATCH /session/account/profile
As signUp (creating account) is separated from signIn (creating session), we can't send a Authorization: Bearer ... token. I would suggest we allow to authenticate traditionally with Authoriziation: Basic ... as well, so we would send headers.authorization = 'Basic ' + base64encode('pat:secret')

Authentication with Basic ... and also Token ... will be required for the admin client, too: https://github.com/hoodiehq/hoodie-client-account/tree/master/admin