use strong params in avatar controllers - fix #8341