check permissions for "upload avatar" button

compability with #644 readonly installation