ignore public/uploads, add avatar to perimit params, more rspec