move password desciption - looks like in the wrong place
add doc for upload user avatar