Add support for secure avatar url

Similar to omniauth-twitter and omniauth-facebook, when secure_image_url is set, the secure avatar URL is returned for `picture-url` field.