fix: create profile for single-login-exempt users; add group exemption test

Exempt users returned early before UserProfile.objects.get_or_create,
so users without a profile never got one created on login while
PREVENT_CONCURRENT_LOGINS was enabled. Move the exemption check to
only skip set_login_session, and add coverage for SINGLE_LOGIN_EXEMPT_GROUPS
and for client1 remaining authenticated after a concurrent login.