use mongoose.populate() to return avatar