Oh yeah, and don't let anyone but authenticated to update its avatar.