Escape avatar URL

*This PR also updates this repository to match [vikhyat/discourse-hummingbird#master](https://github.com/vikhyat/discourse-hummingbird).*

I noticed that when a user has a `'` character in their avatar it breaks the link as it isn't escaped. Example: http://forums.hummingbird.me/users/SteppyBot/activity

```html
<img width="120" height="120" src="http://static.hummingbird.me/users/avatars/000/046/479/thumb/step4seven" s_profile_picture.png?1403095692'="" class="avatar">
```