Prevent XSS: Encode avatar hash and size as well.