/avatars static access, `user.avatar` is now a URI