exposing avatar url and enabling cors

Adding in the avatarId as an exposed field and allowing cors requests to the avatarId and avatar endpoints