refactor routes 2
Return 401 when not autohorized to see avatar