changed permission for user avatars