Initial express routes for getting / posting

* Some avatar methods should have been static.