tentive fix for required csrf token
update users#update_avatar method