missing escaping at the avatar for mycurriki, was transforming the absolute URL returned by getSkinFile into an a element.
paul