use default avatar if none is provided, fix passport localstrategy