Security fix
Merge branch 'personal_messages'

Conflicts:
	app/controllers/messages_controller.rb
added avatar in allowed users fields
Merge branch 'master' into personal_avatar
Added avatar functionality + minor fixes