fix url replacement
pw check only if pw is needed
set avatar size
workbench acccess only for admins