Upload the avatar to an AM using FileReader.readAsDataURL() and the encoded data can work inline in HTML.
Then use an Alias with a URI like "nxtavatar:AM_TRANS_ID_HERE".
Prefer to store a link to the avatar which any client can pick up.
Expanding on this...
How about this - all accounts automatically own the alias
This alias is locked to the account.
You use this alias to store in URI format a hierarchy of parameters for the person who owns the account - this can be set and managed though the clients - one of these is the avatar.
Yes, this would be the solution - if that alias of account number was locked and only the account itself can own it, then we can do this. If it is squattable, then it isn't possible to do.
CFB, what are your thoughts?