Defaulting to discourse.org CDN for avatars is a privacy and security risk

[mpalmer (Matt Palmer)]

BTW, for everyone playing along at home, I’ve created this pull request to implement avatar proxying. Testing would be appreciated; success/failure comments on the PR preferred.