restrict possible image scales

This is done to prevent attackers from using up a lot of disk
space by requesting many differently sized or very large scales
of an image
use fallback avatar for deleted users

the avatar url can be generated but will 404 as the user