This reduces chances of errors where consumers of strings mutate inputs and reduces memory usage of the app. Test suite passes now, but there may be some stuff left, so we will run a few sites on a branch prior to merging
* SECURITY: only allow picking of avatars created by self Also adds origin tracking to all uploads including de-duplicated uploads