load avatars through https