Do not send user_id on avatar upload. Only authenticated users can upload their avatar.