check user permission before upload avatar