ProfileAvatar doesn't specify permissions

[`ProfileAvatar`](/incuna/django-user-management/blob/v2.1.1/user_management/api/avatar/views.py#L12-L31) doesn't set `permission_classes`. This should use `IsAuthenticated` to avoid the possibility of misconfiguration.
Why are you setting `request.user` for an unauthenticated request?