Moved default avatar to local so it can be served via https.

This is so the `/game` endpoint is fully secure.