Allow admin to set default avatar explicitly.

This is to get around a heisenbug we're seing in production, where
*sometimes* the request.static_url returns the url of badges.fp.o, and
*other* times it returns localhost.  Very frustrating.

If we just let the admin hardcode it, everything will be easier.