user image bug fixed
removed url_avatar in security.js