tests for user avatar GET endpoints - apikey
tests for user avatar GET endpoints - session
tests for user avatar GET endpoints - unauthenticated