user: Do not allow a nonimage for avatar.

* Client: Alert if user upload nonimage for avatar.
* Server: Do not update avatar if the new one is not an image.