never call user.picture.url, use user.get_picture_url instead