Set up a javascript variable to refer directly to a users avatar, but getting 403 Forbidden error