Added permissions to Profile Avatar

Added tests
Removed unused mock
Removed request.user
Added doc string
removed user from unauthorised put
Remove post
Removed IsAuthenticatedOrReadOnly
Merge pull request #74 from incuna/profile-avatat-perm

ProfileAvatar doesn't specify permissions