each uploaded file should have a unique filename

[robbyt]

without this fix, it's possible to replace another user's avatar by uploading an image with the same filename. fixes #17