Add cache expiry on avatar creation/removal

Query by user id only, not projects, too.

Adjust comment

Remove project_id from lookup

Add entry to CHANGELOG

Restrict callback to user model