add image authorization on upload_avatar

Prevents that unauthorized files are uploaded as avatars.