Fix SSO avatar downloading issues.

Fixes some things I missed (sorry).

* Follow redirects when downloading SSO avatars. — Some servers does redirections (because of caching, whatsnot). A more valid use case are servers that redirects from http to https, which, unfortunately, OpenURI disables no matter what. The solution here is to just have the SSO host serve urls that don't redirect from http to https.

* Add proper image extensions to downloaded SSO avatars. — Used FastImage to detect the actual image type rather than relying on the filename.

`Upload.create_for` could, and should probably handle file detection/extension (right now, it just checks the supplied filename if it's an image). But I just went for the route which touches the least number of components.