Restrict access to avatar edit page
Extract access check from operator controllers
Do not use IDs from form fields
Remove "$messages" global variable
Replace "operator/translate.php" with a controller