new api endpoint to access a users avatar without authentication