Avatar uploads seem to be working now. Mostly.
Moved avatar update function to usermeta, load user object on every api request when logged in.