add avatar controller to replace old servlet
move things around a bit
we don't include the sha1 javascript hack anymore.