Avatars server checks permissions. #29