Remove requesttoken for avatars

First step for https://github.com/owncloud/core/issues/11915

core/avatar/avatarcontroller.php

@@ -91,6 +91,7 @@ class AvatarController extends Controller {
 
 	/**
 	 * @NoAdminRequired
+	 * @NoCSRFRequired
 	 *
 	 * @param string $userId
 	 * @param int $size

core/js/jquery.avatar.js

@@ -76,8 +76,8 @@
 		var $div = this;
 
 		var url = OC.generateUrl(
-			'/avatar/{user}/{size}?requesttoken={requesttoken}',
-			{user: user, size: size * window.devicePixelRatio, requesttoken: oc_requesttoken});
+			'/avatar/{user}/{size}',
+			{user: user, size: size * window.devicePixelRatio});
 
 		$.get(url, function(result) {
 			if (typeof(result) === 'object') {

settings/js/personal.js

@@ -321,7 +321,7 @@ $(document).ready(function () {
 	var url = OC.generateUrl(
 		'/avatar/{user}/{size}',
 		{user: OC.currentUser, size: 1}
-	) + '?requesttoken=' + encodeURIComponent(oc_requesttoken);
+	);
 	$.get(url, function (result) {
 		if (typeof(result) === 'object') {
 			$('#removeavatar').hide();