Revert "do not protect Controller#perform_caching"

This reverts commit ac3b9195d9c009b89894a4c3fbcefd0490c8bb25.
fix avatar uploads - fixes #8341

when setting perform_caching to true we also protected the method
-> broke external call of that method. using hide_action instead.

Also moved this into a shared module and changed avatar into singular
resource for groups and me