ProfileAvatar doesn't specify permissions

[`ProfileAvatar`](/incuna/django-user-management/blob/v2.1.1/user_management/api/avatar/views.py#L12-L31) doesn't set `permission_classes`. This should use `IsAuthenticated` to avoid the possibility of misconfiguration.
You're not actually testing `post` here.