More permission checks, new services
Fixed the live problem, correctly injected avatar service