Avatar urls don't need to be signed (the attachment is public)