[API] should return user's avatar url