Security issue: First comment in a profile is mistaken for the personal information

The first comment in a profile is displayed in the "About" field of the profile, allowing any user with "Comment" rights to change parts of the profile of other users. Since currently comments can contain JavaScript (see XWIKI-4875), this can be used to insert a profile worm into the profile of a more privileged user (e.g. Admin).

To reproduce, write the following text as first comment on the user profile:

{{html}}<script>alert("html")</script>{{/html}}