During JIT provisioning, how are profile and permission set assignments determined, and what happens if the JIT assertion does not include profile information?