exposing avatar url and enabling cors