permissions and more user profile things
avatar uploader
change uploader