use HTTPS for avatar URLs