user can set avatar with url
users can update passwords, not avatars yet, fixed missing missing.png for new avatar styles