add code to prevent modifying other user's avatar