Fix glitch: starts-with policy is not strict enough

A user can upload and overwrite another's avatar by changing guid part of key in the form.