adding in a new endpoint to expose avatars and adding in CORs support with restrictions