oops, set res.locals.avatar in the wrong place.