app domain is now used in reset password
fetch gravatar image when POST /users